Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2026-50010

Improper Verification of Cryptographic Signature

Published: Jun 12, 2026 | Modified: Aug 14, 2026
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 IMPORTANT
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-50010
CWEhttps://cwe.mitre.org/data/definitions/347.html

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSEs internal AbstractTrustManagerWrapper nor Nettys own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm=HTTPS by default, a client built with SslContextBuilder.forClient().trustManager(somePlainX509TrustManager) performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Weakness

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Software

NameVendorStart VersionEnd Version
NettyNetty*4.1.135 (excluding)
NettyNetty4.2.0 (including)4.2.15 (excluding)
Cryostat 4 on RHEL 9RedHatcryostat/cryostat-reports-rhel9:4.2.0-13*
Cryostat 4 on RHEL 9RedHatcryostat/cryostat-rhel9:4.2.0-13*
Cryostat 4 on RHEL 9RedHatcryostat/jfr-datasource-rhel9:4.2.0-13*
Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1RedHatnetty-handler*
Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16RedHatnetty-handler*
Red Hat build of Quarkus 3.27.4.SP1RedHatnetty-handler*
Red Hat build of Quarkus 3.33.2.SP1RedHatnetty-handler*
Red Hat Data Grid 8.6.2RedHatnetty-handler*
Red Hat JBoss Enterprise Application Platform 7.4.25RedHatnetty-handler*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-activemq-artemis-0:2.16.0-22.redhat_00057.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-glassfish-jsf-0:2.3.14-11.SP11_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-jackson-annotations-0:2.18.8-1.redhat_00003.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-jackson-core-0:2.18.8-1.redhat_00003.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-jackson-databind-0:2.18.8-1.redhat_00003.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-jackson-jaxrs-providers-0:2.18.8-1.redhat_00003.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-jackson-modules-base-0:2.18.8-1.redhat_00003.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-jackson-modules-java8-0:2.18.8-1.redhat_00003.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-jboss-remoting-0:5.0.31-3.SP2_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-jboss-server-migration-0:1.10.0-46.Final_redhat_00044.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-picketlink-bindings-0:2.5.5-30.SP12_redhat_00020.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-picketlink-federation-0:2.5.5-24.SP12_redhat_00016.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7RedHateap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap*
Red Hat JBoss Enterprise Application Platform 8.1RedHatnetty-handler*
Red Hat JBoss Enterprise Application Platform 8.1RedHatnetty-handler*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10RedHateap8-eap-product-conf-parent-0:801.7.1-1.GA_redhat_00001.1.el10eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10RedHateap8-netty-0:4.1.135-1.Final_redhat_00001.1.el10eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10RedHateap8-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el10eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10RedHateap8-wildfly-0:8.1.7.1-1.GA_redhat_00004.1.el10eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8RedHateap8-eap-product-conf-parent-0:801.7.1-1.GA_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8RedHateap8-jose4j-0:0.9.6-2.redhat_00002.1.el8eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8RedHateap8-netty-0:4.1.135-1.Final_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8RedHateap8-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el8eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8RedHateap8-wildfly-0:8.1.7.1-1.GA_redhat_00004.1.el8eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9RedHateap8-eap-product-conf-parent-0:801.7.1-1.GA_redhat_00001.1.el9eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9RedHateap8-jose4j-0:0.9.6-2.redhat_00002.1.el9eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9RedHateap8-netty-0:4.1.135-1.Final_redhat_00001.1.el9eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9RedHateap8-netty-transport-native-epoll-0:4.1.135-1.Final_redhat_00001.1.el9eap*
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9RedHateap8-wildfly-0:8.1.7.1-1.GA_redhat_00004.1.el9eap*
Streams for Apache Kafka 2.9.4RedHatnetty-handler*
Red Hat Offline Knowledge Portal 1.2.7RedHatoffline-knowledge-portal/rhokp-rhel9:1782239370*
NettyUbuntuquesting*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use