{"id":"CVE-2023-4586","aliases":["EUVD-2023-2654","GHSA-57m8-f3v5-hm5m"],"status":"published","title":"Hotrod-client: hot rod client does not enable hostname  validation when using tls that lead to a mitm attack","description":"A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00548,"percentile":0.46182,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-295"],"published":"2023-10-04T10:46:15Z","modified":"2026-09-10T03:50:03Z","products":[{"vendor":"infinispan","product":"hot_rod"},{"vendor":"red hat","product":"red hat data grid 8.4.6"},{"vendor":"redhat","product":"data_grid"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:7676","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4586","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235564","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4586","tags":["advisory"]},{"url":"https://security.snyk.io/vuln/SNYK-JAVA-IONETTY-1042268","tags":["web"]},{"url":"https://github.com/netty/netty/issues/8537","tags":["web"]},{"url":"https://docs.oracle.com/javase/8/docs/api/javax/net/ssl/SSLParameters.html#setEndpointIdentificationAlgorithm-java.lang.String-","tags":["web"]},{"url":"https://github.com/advisories/GHSA-57m8-f3v5-hm5m"},{"url":"https://github.com/netty/netty","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-4586","title":"Hotrod-client: hot rod client does not enable hostname  validation when using tls that lead to a mitm attack","description":"A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.","status":"published","published":"2023-10-04T10:46:15.01Z","modified":"2025-11-20T17:55:46.993Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:30.851125Z"}],"euvd":[{"id":"EUVD-2023-2654","description":"A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.","status":"published","published":"2023-10-04T10:46:15Z","modified":"2025-11-20T17:55:46Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:14.564249Z"}],"ghsa":[{"id":"GHSA-57m8-f3v5-hm5m","title":"Withdrawn Advisory: Netty-handler does not validate host names by default","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the underlying vulnerability only concerns Red Hat's Hot Rod client, which is not in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references.\n\n## Original Description\nNetty-handler has been found to no validate hostnames when using TLS in its default configuration. As a result netty-handler is vulnerable to man-in-the-middle attacks. Users would need to set the protocol to \"HTTPS\" in the SSLParameters of the SSLEngine to opt in to host name validation. A change in default behavior is expected in the `5.x` release branch with no backport planned.\n\nIn the interim users are advised to enable host name validation in their configurations.\nSee https://github.com/netty/netty/issues/8537 for details on the forthcoming change in default behavior.","status":"withdrawn","published":"2023-10-04T12:30:14Z","modified":"2023-11-10T05:04:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:37:19.438667Z"}],"nvd":[{"id":"CVE-2023-4586","description":"A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack.","status":"published","published":"2023-10-04T11:15:10.5Z","modified":"2026-06-17T06:38:09.553Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-20","CWE-295"],"updated_at":"2026-11-02T14:08:35.022405Z"}],"osv":[{"id":"GHSA-57m8-f3v5-hm5m","title":"Withdrawn Advisory: Netty-handler does not validate host names by default","description":"## Withdrawn Advisory\nThis advisory has been withdrawn because the underlying vulnerability only concerns Red Hat's Hot Rod client, which is not in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references.\n\n## Original Description\nNetty-handler has been found to no validate hostnames when using TLS in its default configuration. As a result netty-handler is vulnerable to man-in-the-middle attacks. Users would need to set the protocol to \"HTTPS\" in the SSLParameters of the SSLEngine to opt in to host name validation. A change in default behavior is expected in the `5.x` release branch with no backport planned.\n\nIn the interim users are advised to enable host name validation in their configurations.\nSee https://github.com/netty/netty/issues/8537 for details on the forthcoming change in default behavior.","status":"withdrawn","published":"2023-10-04T12:30:14Z","modified":"2026-09-10T03:50:03.467623256Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:37.864461Z"}]}}