CVE-2026-44249

Description

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

8.1 / 10

CVSS vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Effective score

8.1 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-44249

Linked Threat

CVE-2026-44249 — CVE-2026-44249

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-06-11 22:16:56 UTC

NVD last modified

2026-07-30 12:18:41 UTC

NVD CVSS v3.1

8.1 / 10 HIGH source: security-advisories@github.com

NVD CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

2.2 / 10

Impact subscore

5.9 / 10

EPSS score

0.0057 (probability of exploitation in next 30 days)

EPSS percentile

44.10% vs all CVEs — higher = more likely to be exploited, as of 2026-08-01

NVD-assigned CWE(s): CWE-284, CWE-697, CWE-1287 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-36327

Assigner

GitHub_M

Published

Jun 11, 2026, 8:46:14 PM

Updated

Jul 30, 2026, 12:05:00 PM

EUVD base score (CVSS 3.1)

8.1 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EUVD-reported EPSS

0.5700

Vendors

netty

Products

netty (< 4.1.135.Final)

netty (4.2.0.Final, < 4.2.15.Final)

Aliases

GHSA-3qp7-7mw8-wx86

ENISA description: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-44249 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-44249 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• CVE-2026-44249 - Vulnerability Details - OpenCVE
  web:app.opencve.io

  Remediation No vendor fix or workaround currently provided. OpenCVE Recommended Actions Upgrade to Netty 4.1.135.Final or later in the 4.1.x branch, or 4.2.15.Final or later in the 4.2.x branch to apply the corrected subnet comparison logic.

  2026-06-19 02:38 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-06-19 02:38 UTC
• UBUNTU-CVE-2026-44249 | Mondoo Vulnerability Intelligence
  web:mondoo.com

  UBUNTU- CVE - 2026 - 44249 - HIGH severity: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to ve...

  2026-06-19 02:38 UTC
• Nvd - Cve-2026-44249
  web:nvd.nist.gov

  An official website of the United States government Here's how you know

  2026-06-19 02:38 UTC
• Security Update Guide - Loading - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-06-19 02:38 UTC
• CVE-2026-44249 - security-tracker.debian.org
  web:security-tracker.debian.org

  Vulnerable and fixed packages The table below lists information on source packages.

  2026-06-19 02:38 UTC
• March 13, 2026—Hotpatch KB5084597 (OS Builds 26200.7982 and 26100.7982 ...
  web:support.microsoft.com

  The following summary outlines key issues addressed by this update. The bold text within the brackets indicates the item or area of the change. [Networking] Fixed: This update addresses a security issue in the Windows Routing and Remote Access Service (RRAS) management tool. If you connect to a malicious remote server, an attacker could disrupt the tool or run code on your device. For more ...

  2026-06-19 02:38 UTC
• CVE-2026-44249 in Netty - vuldb.com
  web:vuldb.com

  CVE-2026-44249 in Netty info Summary by MITRE • 06/12/ 2026 Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo ().

  2026-06-19 02:38 UTC
• Microsoft is working on a patch for 'YellowKey ... - Computerworld
  web:www.computerworld.com

  Microsoft says it is considering a patch for a zero-day vulnerability, dubbed YellowKey, that allows attackers with access to a Windows device to bypass Bitlocker encryption protection and read ...

  2026-06-19 02:38 UTC
• Microsoft patches two zero-day flaws in Defender - CSO Online
  web:www.csoonline.com

  Microsoft released emergency fixes for two zero-day vulnerabilities in the malware protection components of Microsoft Defender. The flaws allow local attackers to gain system-level privileges or ...

  2026-06-19 02:38 UTC

Only Available for Registered Users. Sign in to view.