CVE-2026-44249: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

Synopsis

An access-control bypass vulnerability exists in the netty-handler component of the Netty network application framework. A remote attacker with no authentication can exploit a flawed masking operation in IpSubnetFilterRule.compareTo() to make a valid public IPv6 address appear to match (or not match) a configured subnet rule, bypassing IP-based allow or deny lists. Successful exploitation gives the attacker full read, write, and availability impact against services relying on those subnet filters for access control. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment fix versions are published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Netty service over the network; the vulnerable code path is exposed on any network-accessible endpoint that relies on IPv6 subnet filtering.

• AuthenticationNot required

  No credentials are needed; the bypass is exercised at the network filtering layer before any authentication check.

• Victim interactionNot required

  No user interaction is required; the attacker sends crafted IPv6 traffic directly to the service.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker may need to account for specific environmental conditions such as the exact subnet rule configuration and IPv6 address construction to reliably trigger the masking error.

Blast Radius

• A successful attacker bypasses IPv6 subnet allow or deny rules and reaches service endpoints that should have been blocked, reading data those endpoints expose such as stored records, session state, or internal API responses.
• The attacker can issue write operations to endpoints gated only by the bypassed subnet filter, modifying persisted application data or triggering privileged actions.
• If the attacker directs traffic at resource-intensive paths now reachable past the filter, they can exhaust service resources and crash the affected Netty process.
• Any downstream service that trusts access decisions made by the Netty layer inherits the same exposure, widening the reachable attack surface beyond the initial entry point.