ECHO-f62c-6c16-552e
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-f62c-6c16-552e.json
- JSON Data
- https://api.osv.dev/v1/vulns/ECHO-f62c-6c16-552e
- Upstream
- CVE-2026-62243
- GHSA-c3j3-64rf-grvf
- Withdrawn
- 2026-11-04T16:52:57Z
- Published
- 2026-11-01T08:58:28Z
- Modified
- 2026-11-04T17:15:40Z
- Summary
- GHSA-p85m-gvr3-788c: hostname verification skipped on the OpenSSL client path with a plain X509TrustManager when trust-manager wrapping is unavailable (Java 25+). Upstream's fix (in https://github.com/netty/netty/commit/9e05192391, 4.1.137.Final) only adds a check at context creation for an endpoint identification algorithm set with SslContextBuilder.endpointIdentificationAlgorithm(...), which netty added in 4.1.112.Final (0deca94aa1); 4.1.74.Final has no such setting. The other way to ask for hostname verification, SSLParameters on the engine, is the same in 4.1.74.Final and in fixed 4.1.137.Final (it sets SSL_CVERIFY_REQUIRED and leaves the check to the trust manager), and the fix does not change it. CVE-2026-50010, patched above, covers wrapping plain trust managers.
- Details
- References