CVE-2026-62243: Improper Validation of Certificate with Host Mismatch

Netty disables TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. The netty-all artifact is a shaded jar that embeds the vulnerable ReferenceCountedOpenSslClientContext class from version 4.1.1 up to and including version 4.1.68; from version 4.1.69 onwards it ships no bytecode and is not affected.