CVE-2026-75596

Summary

Netty's default SNI entrypoint reparses and recopies previously received ClientHello fragments on every additional TLS handshake record. A remote peer can send a small first record that advertises a large ClientHello length and then drip the body in many tiny records, causing superlinear (quadratic) CPU work before the handshake completes. With 4095 one-byte fragments, the handler recopies 8,386,560 bytes from only 24,579 bytes on the wire — a 341× amplification ratio.

Affected Entrypoints

• io.netty.handler.ssl.SniHandler — default constructors
• io.netty.handler.ssl.SslClientHelloHandler — pre-handshake ClientHello aggregation path

Vulnerable Code Locations

• handler/src/main/java/io/netty/handler/ssl/SniHandler.java:85
• handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:75 (decode entry)
• handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:165 (handshakeBuffer.clear)
• handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:174 (writeBytes re-copy)
• codec-base/src/main/java/io/netty/handler/codec/ByteToMessageDecoder.java:294 (cumulation retention)

Exploit Path

1. TCP connection → SniHandler → SslClientHelloHandler.decode
2. First record: TLS handshake header declaring large ClientHello length (e.g., 4096 bytes)
3. Attacker sends thousands of tiny follow-on handshake records (1 byte each)
4. On each fragment: handshakeBuffer.clear() + writeBytes() re-copies ALL accumulated body bytes
5. Total bytes copied = n*(n+1)/2 where n = number of body bytes → quadratic
6. Event-loop CPU exhausted before SslHandler takes over

Impact

• Vulnerability Type: Inefficient Algorithmic Complexity
• An unauthenticated network attacker can drive disproportionate CPU consumption on the Netty event loop
• Affects all Netty deployments using SniHandler for TLS termination (the default SNI path)
• No privileges, user interaction, or special configuration required
• Can degrade or stall TLS connection handling for all clients on the affected event loop
• The attack requires only modest bandwidth (~25 KB) to trigger significant CPU work

Credits

Found by a security research team from the University of Sydney, focusing on detecting open source software vulnerabilities. Liyi Zhou: https://lzhou1110.github.io/ Ziyue Wang: https://zyy0530.github.io/ Strick: https://str1ckl4nd.github.io/ Maurice: https://maurice.busystar.org/ Chenchen Yu: https://7thparkk.github.io/

Red Hat Lightwell has released io.netty:netty-handler 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-24970, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-75595, and CVE-2026-75596.

CVE-2025-24970: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine

CVE-2026-44249: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

CVE-2026-45416: Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

CVE-2026-50010: Netty's wrapping plain trust manager silently disables hostname verification

CVE-2026-75595: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

CVE-2026-75596: Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

This patched artifact is a drop-in replacement for io.netty:netty-handler 4.1.100.Final from Maven Central.

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

TuxCare rebuilt io.netty:netty-handler to address 2 CVEs. Fixed in 4.1.122.Final-tuxcare.4.

TuxCare rebuilt io.netty:netty-handler to address 2 CVEs. Fixed in 4.1.119.Final-tuxcare.3.

TuxCare rebuilt 8 io.netty packages to address 9 CVEs. Fixed in 4.1.115.Final-tuxcare.9.

TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.114.Final-tuxcare.1.

TuxCare rebuilt 9 io.netty packages to address 13 CVEs. Fixed in 4.1.113.Final-tuxcare.2.

These are all security issues fixed in the netty-4.1.138-1.1 package on the GA media of openSUSE Tumbleweed.

This update for netty, netty-tcnative fixes the following issues:

• CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501).
• CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite (bsc#1275500).
• CVE-2026-62243: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455).
• CVE-2026-62380: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456).
• CVE-2026-75595: fragmented TLS ClientHello causes fallback to default SslContext and allows for SNI routing and mTLS requirement bypass (bsc#1276420).
• CVE-2026-75596: fragmented ClientHellorecords can trigger quadratic pre-handshake reassembly in default SNI parsing (bsc#1276421).
• CVE-2026-76816: missing input validation in MqttEncoder allows for null-byte injection, topic hijacking, and ACL bypassing (bsc#1277243).
• CVE-2026-89044: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding (bsc#1280048).
• CVE-2026-93488: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084).
• CVE-2026-93491: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085).
• CVE-2026-93492: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132).
• CVE-2026-93493: missing nextUpdate field in OCSP responses leads to silent validation bypass (bsc#1281431).
• CVE-2026-93494: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506).
• CVE-2026-93558: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (bsc#1282140).
• CVE-2026-93560: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141).
• CVE-2026-93562: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362).
• CVE-2026-93563: unbounded multi-line response accumulation in SmtpResponseDecoder leads to memory exhaustion and a DoS (bsc#1281432).
• CVE-2026-93564: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363).
• CVE-2026-93565: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364).
• CVE-2026-93566: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366).
• CVE-2026-93567: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (bsc#1282367).
• CVE-2026-93568: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370).
• CVE-2026-93569: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (bsc#1282372).
• CVE-2026-93572: multiplication of patched preallocation limits in RedisArrayAggregator nested RESP headers can lead to denial of service (bsc#1281433).
• CVE-2026-93573: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373).
• CVE-2026-93574: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374).
• CVE-2026-93575: missing validations in the MqttDecoder can lead to excessive resource consumption and a DoS (bsc#1281434).
• CVE-2026-93576: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507).
• CVE-2026-93578: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass (bsc#1281435).
• CVE-2026-93579: HTTP/2 header field values are not validated by default (bsc#1282378).

Changes for netty:

• Upgrade to upstream version 4.1.138

Changes for netty-tcnative:

• Upgrade to version 2.0.84 Final