CVE-2026-44249

Name	CVE-2026-44249
Description	Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1139807

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
netty (PTS)	bullseye	1:4.1.48-4+deb11u2	vulnerable
	bullseye (security)	1:4.1.48-4+deb11u3	vulnerable
	bookworm, bookworm (security)	1:4.1.48-7+deb12u2	vulnerable
	trixie (security), trixie	1:4.1.48-10+deb13u1	vulnerable
	forky, sid	1:4.1.48-16	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
netty	source	(unstable)	(unfixed)			1139807

https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86