CVE-2026-44249: netty Improper Access Control

CVSS: 8.1v3.1HighModified

AliasesUBUNTU-CVE-2026-44249DEBIAN-CVE-2026-44249CGA-248q-jmmm-x7w9+915 more

Published 11-06-2026Last modified 18-09-2026

Vulnerability summary

CVE-2026-44249 is a high (CVSS 8.1) Improper Access Control vulnerability in netty. EPSS estimates a 1.29% chance of exploitation in the next 30 days, higher than 69.7% of scored vulnerabilities.

Overall risk

33/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.1/10

010

High · v3.1 (CVE.org)

EPSS score

1.29%

0%100%

Low · +0.27 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 9 · Related 3

OPENSUSE-SU-2026:11033-1 RHSA-2026:49700 RHSA-2026:53644 RHSA-2026:53645 RHSA-2026:53646 RHSA-2026:76128+4 more

Timeline

11-06-2026
PublishedVulnerability first disclosed.
18-09-2026
Last modifiedVulnerability information updated.

Description

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

CVSS metrics

7 scores · 7 sources · 1 version

v3.18.1

EPSS trend

Probability

1.29%

Chance of exploitation in the next 30 days

Percentile

70%

Versus all other CVEs

30-day change

+0.27 pp

From 1.03% on 18-09-2026

18-09-202618-10-2026

EPSS score

1.29%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard200 products

airbyte-server< 2.0.0-r1
airbyte-server-fips< 2.0.0-r1
akhq< 0.27.1-r3
apache-activemq-artemis< 2.54.0-r5
apache-camel-karavan-devmode< 4.18.1-r3

apache-hop< 2.18.0-r3
apache-hop-fips< 2.18.0-r4
apache-nifi< 2.9.0-r13
apache-nifi-registry< 2.9.0-r10
apache-pulsar-4.0< 4.0.11-r0
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.2-r3
apache-pulsar-fips-4.0< 4.0.11-r2
apache-pulsar-fips-4.1All versions (No fix recorded)
apicurio-registry< 3.3.0-r2
camunda-8.8< 8.8.27-r1
camunda-8.9< 8.9.6-r1
camunda-zeebe-8.6< 8.6.39-r6
camunda-zeebe-8.7< 8.7.30-r1
camunda-zeebe-8.8< 8.8.25-r1 | < 8.8.26-r0
camunda-zeebe-8.9< 8.9.6-r1
cassandra-5.0< 5.0.8-r6
cassandra-fips-5.0< 5.0.6-r9
cassandra-reaper< 4.2.4-r2
celeborn-0.5< 0.5.4-r26 | All versions (No fix recorded) | < 0.5.4-r25
celeborn-0.6All versions (No fix recorded) | < 0.6.3-r8 | < 0.6.3-r7
celeborn-0.7< 0.7.0-r3 | < 0.7.0-r7
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.17-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3< 9.3.6-r0
commercial-elasticsearch-9.4< 9.4.3-r0
docker-selenium-base< 4.44.0.20260505-r2
docker-selenium-hub< 4.48.0.20260909-r0
docker-selenium-router< 4.48.0.20260909-r0
docker-selenium-standalone< 4.48.0.20260909-r0
druid< 37.0.0-r56 | < 37.0.0-r12
elasticsearch-7All versions (No fix recorded)
elasticsearch-7-iamguardedAll versions (No fix recorded)
elasticsearch-8.19< 8.19.16-r1
elasticsearch-8.19-iamguarded< 8.19.16-r1
elasticsearch-9.1All versions (No fix recorded)
elasticsearch-9.1-iamguardedAll versions (No fix recorded)
elasticsearch-9.1-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.2All versions (No fix recorded)
elasticsearch-9.2-iamguarded< 9.2.8-r13
elasticsearch-9.2-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.3< 9.3.7-r1
elasticsearch-9.3-iamguarded< 9.3.7-r1
elasticsearch-9.3-iamguarded-fips< 9.3.7-r1
elasticsearch-9.4< 9.4.2-r2
elasticsearch-9.4-iamguarded< 9.4.2-r2
elasticsearch-9.4-iamguarded-fips< 9.4.2-r3
elasticsearch-fips-8.19< 8.19.16-r1
elasticsearch-fips-9.1All versions (No fix recorded)
elasticsearch-fips-9.2All versions (No fix recorded)
elasticsearch-fips-9.3< 9.3.7-r1
elasticsearch-fips-9.4< 9.4.2-r3
flyway< 12.8.1-r3 | < 13.0.0-r1
flyway-fips< 12.8.1-r1
ghidra< 12.1.2-r2
gremlin-server< 3.8.1-r2
grpc-java-fips-1.56.0-m2< 1.56.0-r6
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded) | < 3.5.0-r12 | < 3.5.0-r3
hono-adapter-mqtt< 2.7.0-r21
hono-cli< 2.7.0-r21
hono-service-auth< 2.7.0-r21
hono-service-command-router< 2.7.0-r21
hono-service-device-registry-jdbc< 2.7.0-r21
infinispan-15.0< 15.0.22-r10 | < 15.0.22-r11
infinispan-15.1< 15.1.7-r20
infinispan-15.2< 15.2.6-r19
infinispan-16.1< 16.1.4-r3
kafbat-ui< 1.5.0-r1
kafbat-ui-fips< 1.5.0-r6
kafka_exporter-strimzi-compat< 1.2.0-r5 | < 1.2.0-r4
kafka-3.7< 3.7.2-r56
kafka-3.8< 3.8.1-r56
kafka-3.9< 3.9.2-r7
kafka-bridge< 1.0.0-r6
kafka-bridge-fips< 1.0.0-r3
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.2< 2025.2.4-r6
kayenta-2025.4< 2025.4.6-r1
kayenta-2026.0< 2026.0.4-r1
kayenta-2026.1< 2026.1.1-r1
kayenta-fips-2025.2All versions (No fix recorded)
kayenta-fips-2025.4< 2025.4.3-r10
kayenta-fips-2026.0< 2026.0.4-r1
kayenta-fips-2026.1< 2026.1.1-r1
keycloak-26.4All versions (No fix recorded)
keycloak-26.4-iamguarded-compatAll versions (No fix recorded)
keycloak-26.4-operatorAll versions (No fix recorded)
keycloak-26.5< 26.5.7-r7
keycloak-26.5-iamguarded-compat< 26.5.7-r7
keycloak-26.5-operator< 26.5.7-r7
keycloak-26.6< 26.6.3-r2
keycloak-26.6-iamguarded-compat< 26.6.3-r2
keycloak-26.6-operator< 26.6.3-r2
keycloak-fips-26.4All versions (No fix recorded)
keycloak-fips-26.4-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.4-operatorAll versions (No fix recorded)
keycloak-fips-26.5< 26.5.7-r13
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r13
keycloak-fips-26.5-operator< 26.5.7-r13
keycloak-fips-26.6< 26.6.3-r1
keycloak-fips-26.6-iamguarded-fips< 26.6.3-r1
keycloak-fips-26.6-operator< 26.6.3-r1
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r3
knative-kafka-broker-1.21-receiver-loom< 1.21.4-r3
knative-kafka-broker-1.22-dispatcher-loom< 1.22.1-r3
knative-kafka-broker-1.22-receiver-loom< 1.22.1-r3
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.3-r9
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.3-r9
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.1-r3
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.1-r3
kserve-modelmesh< 0.12.0-r35
localstack< 4.14.0-r13
logstash-8.19< 8.19.16-r1
logstash-8.19-iamguarded-compat< 8.19.16-r1
logstash-8.19-with-output-opensearch< 8.19.16-r1
logstash-9.1All versions (No fix recorded)
logstash-9.1-bitnami-compatAll versions (No fix recorded)
logstash-9.1-iamguarded-compatAll versions (No fix recorded)
logstash-9.1-with-output-opensearchAll versions (No fix recorded)
logstash-9.2< 9.2.8-r6
logstash-9.2-iamguarded-compat< 9.2.8-r6
logstash-9.2-with-output-opensearch< 9.2.8-r6
logstash-9.3All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded)
logstash-9.4< 9.4.2-r5
logstash-9.4-iamguarded-compat< 9.4.2-r5
logstash-fips-9.4< 9.4.2-r4
logstash-fips-9.4-iamguarded-compat< 9.4.2-r4
management-api-for-apache-cassandra-4.0< 0.1.117-r3
management-api-for-apache-cassandra-4.1< 0.1.117-r2
management-api-for-apache-cassandra-5.0< 0.1.119-r0 | < 0.1.120-r0
neo4j-2025.10All versions (No fix recorded)
neo4j-2025.11All versions (No fix recorded)
neo4j-2025.12All versions (No fix recorded)
neo4j-2026.01All versions (No fix recorded)
neo4j-2026.02< 2026.02.3-r4
neo4j-2026.03< 2026.03.1-r4
neo4j-2026.04< 2026.04.0-r3
neo4j-2026.05< 2026.05.0-r1
neo4j-5.26< 5.26.27-r1
nuxeo-2023< 2023.40-r7
opensearch-2< 2.19.5-r1
opensearch-2-ml-commons< 2.19.5-r1
opensearch-2-performance-analyzer< 2.19.5-r1
opensearch-2-repository-azure< 2.19.5-r1
opensearch-2-repository-s3< 2.19.5-r1
opensearch-2-security< 2.19.5-r1
opensearch-2-transport-nio< 2.19.5-r1
opensearch-3< 3.6.0-r7
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compatAll versions (No fix recorded)
opensearch-3-ml-commons< 3.6.0-r7
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-notifications< 3.6.0-r7
opensearch-3-performance-analyzer< 3.6.0-r7
opensearch-3-repository-azure< 3.6.0-r7
opensearch-3-repository-s3< 3.6.0-r7
opensearch-3-security< 3.6.0-r7
opensearch-3-security-analytics< 3.8.0-r2
opensearch-fips-3< 3.7.0-r0
opensearch-fips-3-ml-commons< 3.7.0-r0
opensearch-fips-3-notifications< 3.7.0-r0
opensearch-fips-3-performance-analyzer< 3.7.0-r0
opensearch-fips-3-repository-azure< 3.7.0-r0
opensearch-fips-3-repository-s3< 3.7.0-r0
opensearch-fips-3-security< 3.7.0-r0
opensearch-fips-3-security-analytics< 3.8.0-r2
pinot< 1.5.0-r15
pinot-fips< 1.5.0-r11
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
reposilite< 3.5.28-r4
request-9047-keycloak-fips-26.4< 26.4.7-r18
request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r18
request-9047-keycloak-fips-26.4-operator< 26.4.7-r18
request-9047-keycloak-fips-26.5< 26.5.7-r6
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r6
request-9047-keycloak-fips-26.5-operator< 26.5.7-r6
request-9047-keycloak-fips-26.6< 26.6.3-r1
request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.3-r1
request-9047-keycloak-fips-26.6-operator< 26.6.3-r1
s3proxy< 3.1.0-r8
s3proxy-fips< 3.1.0-r7
seata-server< 2.6.0-r12
selenium-server< 4.44.0-r2
solr-10< 10.0.0-r5
solr-10-iamguarded-compat< 10.0.0-r5

Show all 200

1 vendor · 200 products · Showing 200 of 368. Use Open JSON for the complete list.

References

33 links

github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
github.com/netty/netty/releases/tag/netty-4.1.135.FinalX Refsource MISCREPORTWEBRelease Notes
github.com/netty/netty/releases/tag/netty-4.2.15.FinalX Refsource MISCREPORTWEBRelease Notes
access.redhat.com/security/cve/CVE-2026-44249VDB EntryX Refsource REDHATAdvisory
bugzilla.redhat.com/show_bug.cgi?id=2488081Issue TrackingX Refsource REDHATREPORT
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.jsonX Sadp Csaf VexWEB
access.redhat.com/errata/RHSA-2026:49700Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:53644Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:53645Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:48151Vendor AdvisoryX Refsource REDHATAdvisory

Show all 33 references

access.redhat.com/errata/RHSA-2026:53646Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:66545Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:66488Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26586Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:41951Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:50085Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:49701Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:28573Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:65126Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:48124Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:36820Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:37390Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26018Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:26017Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:34608Vendor AdvisoryX Refsource REDHATAdvisory
access.redhat.com/errata/RHSA-2026:54435Vendor AdvisoryX Refsource REDHATAdvisory
ubuntu.com/security/CVE-2026-44249REPORT
www.cve.org/CVERecord?id=CVE-2026-44249REPORT
security-tracker.debian.org/tracker/CVE-2026-44249Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44249.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-44249Advisory
access.redhat.com/errata/RHSA-2026:53806Advisory
github.com/netty/nettyPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities