8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44249

CVE-2026-44249: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44249

CVE-2026-44249:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-handler	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-handler	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-3qp7-7mw8-wx86, is an access control bypass in Netty's IpSubnetFilter for IPv6 addresses. The analysis of the patch commit reveals two distinct but related flaws that contribute to this bypass.

First, in the io.netty.handler.ipfilter.IpSubnetFilterRule.compareTo method, the logic for checking if an incoming IPv6 address belongs to a configured subnet was incorrect. It used the rule's networkAddress for the bitwise masking operation instead of the correct subnetMask. This fundamental error in the comparison logic meant that the filter was not correctly verifying if an IP was part of the specified subnet, allowing unauthorized addresses to pass the filter.

Second, a helper function, io.netty.handler.ipfilter.IpSubnetFilterRule$Ip6SubnetFilterRule.ipToInt, which converts an Inet6Address to a BigInteger for comparison, contained a bug. It failed to handle IPv6 addresses where the most significant bit is set, causing them to be interpreted as negative numbers. This led to incorrect comparison results, providing another avenue for an attacker to bypass the access controls with a specially crafted IPv6 address.

The exploitation of this vulnerability would involve an attacker sending traffic from an IPv6 address that should be blocked by the IpSubnetFilter. Due to these flaws, the filter would incorrectly evaluate the rule, fail to block the request, and grant unauthorized access. The patch rectifies both issues, ensuring the correct mask is used and that IPv6 addresses are always handled as positive numbers during comparison.

Vulnerable functions

io.netty.handler.ipfilter.IpSubnetFilterRule.compareTo

handler/src/main/java/io/netty/handler/ipfilter/IpSubnetFilterRule.java

The method performs a bitwise AND operation on the incoming remote IP address with the configured 'networkAddress' instead of the 'subnetMask'. This incorrect masking allows an attacker to craft an IP address that bypasses the subnet filter rules, leading to an access control bypass.

io.netty.handler.ipfilter.IpSubnetFilterRule$Ip6SubnetFilterRule.ipToInt

handler/src/main/java/io/netty/handler/ipfilter/IpSubnetFilterRule.java

This helper function, used by the comparison logic, incorrectly converted IPv6 addresses into BigIntegers. The constructor `new BigInteger(byte[])` interprets the bytes as a two's-complement number, which can be negative if the most significant bit is set. This caused incorrect comparisons for certain IPv6 addresses, allowing an attacker to bypass the filter. The fix ensures the BigInteger is always positive by using the `new BigInteger(1, byte[])` constructor.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.