{"id":"CVE-2026-75596","aliases":["CLSA-2026-1789214678","CLSA-2026-1789228568","CLSA-2026-1792115780","CLSA-2026-1792686520","CLSA-2026-1793707066","DEBIAN-CVE-2026-75596","EUVD-2026-63092","GHSA-3qp7-7mw8-wx86","GHSA-4g8c-wm8x-jfhw","GHSA-c4c3-7fpv-j4q5","GHSA-c653-97m9-rcg9","GHSA-fccg-mwvh-qqg4","GHSA-x4gw-5cx5-pgmh","RHLW-2026-313117b0cad7329e","SUSE-SU-2026:4391-1","UBUNTU-CVE-2026-75596","openSUSE-SU-2026:11882-1"],"status":"published","title":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00374,"percentile":0.31608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-407"],"published":"2026-08-19T20:56:21Z","modified":"2026-11-03T19:30:06Z","fixes":[{"ecosystem":"Maven","package":"io.netty:netty-handler","fixed_in":["4.2.17.Final","4.1.137.Final"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"last_affected":"4.2.16.Final"},{"fixed":"4.2.17.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.136.Final"},{"fixed":"4.1.137.Final"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.4"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1","4.1.122.Final-tuxcare.2","4.1.122.Final-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.3"}]}],"versions":["4.1.119.Final","4.1.119.Final-tuxcare.1","4.1.119.Final-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.2"}]}],"versions":["4.1.113.Final","4.1.113.Final-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"Debian:12","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16","1:4.1.48-7","1:4.1.48-7+deb12u1","1:4.1.48-7+deb12u2","1:4.1.48-8","1:4.1.48-9"]},{"source":"osv","ecosystem":"Debian:13","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-10+deb13u1","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Debian:14","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"fixed":"4.2.17.Final"}]}],"versions":["4.2.0.Final","4.2.1.Final","4.2.10.Final","4.2.11.Final","4.2.12.Final","4.2.13.Final","4.2.14.Final","4.2.15.Final","4.2.16.Final","4.2.2.Final","4.2.3.Final","4.2.4.Final","4.2.5.Final","4.2.6.Final","4.2.7.Final","4.2.8.Final","4.2.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.137.Final"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.101.Final","4.1.102.Final","4.1.103.Final","4.1.104.Final","4.1.105.Final","4.1.106.Final","4.1.107.Final","4.1.108.Final","4.1.109.Final","4.1.11.Final","4.1.110.Final","4.1.111.Final","4.1.112.Final","4.1.113.Final","4.1.114.Final","4.1.115.Final","4.1.116.Final","4.1.117.Final","4.1.118.Final","4.1.119.Final","4.1.12.Final","4.1.120.Final","4.1.121.Final","4.1.122.Final","4.1.123.Final","4.1.124.Final","4.1.125.Final","4.1.126.Final","4.1.127.Final","4.1.128.Final","4.1.129.Final","4.1.13.Final","4.1.130.Final","4.1.131.Final","4.1.132.Final","4.1.133.Final","4.1.134.Final","4.1.135.Final","4.1.136.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final-rhlw-00001"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.138-150200.4.56.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1","1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:4.0.32-1","1:4.0.33-1","1:4.0.34-1","1:4.0.34-1ubuntu0.1~esm1","1:4.0.34-1ubuntu0.1~esm2","1:4.0.34-1ubuntu0.1~esm3","1:4.0.34-1ubuntu0.1~esm4","1:4.0.34-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1","1:4.1.7-4ubuntu0.1+esm1","1:4.1.7-4ubuntu0.1+esm2","1:4.1.7-4ubuntu0.1+esm3","1:4.1.7-4ubuntu0.1+esm4","1:4.1.7-4ubuntu0.1+esm5","1:4.1.7-4ubuntu0.1+esm6","1:4.1.7-4ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.33-1","1:4.1.33-2","1:4.1.33-3","1:4.1.45-1","1:4.1.45-1ubuntu0.1~esm1","1:4.1.45-1ubuntu0.1~esm2","1:4.1.45-1ubuntu0.1~esm3","1:4.1.45-1ubuntu0.1~esm4","1:4.1.45-1ubuntu0.1~esm6","1:4.1.45-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-4","1:4.1.48-4+deb11u1build0.22.04.1","1:4.1.48-4+deb11u2build0.22.04.1","1:4.1.48-4+deb11u2ubuntu0.1~esm1","1:4.1.48-4+deb11u2ubuntu0.1~esm2","1:4.1.48-4+deb11u2ubuntu0.1","1:4.1.48-4+deb11u2ubuntu0.1+esm1","1:4.1.48-4+deb11u2ubuntu0.1+esm3","1:4.1.48-4+deb11u2ubuntu0.2","1:4.1.48-4+deb11u2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-7","1:4.1.48-8","1:4.1.48-9","1:4.1.48-9ubuntu0.1~esm1","1:4.1.48-9ubuntu0.1~esm2","1:4.1.48-9ubuntu0.1","1:4.1.48-9ubuntu0.1+esm1","1:4.1.48-9ubuntu0.1+esm3","1:4.1.48-9ubuntu0.2","1:4.1.48-9ubuntu0.2+esm1","1:4.1.48-9ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-16","1:4.1.48-16ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-16","1:4.1.48-16ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.138-1.1"}]}],"bundled":30}],"products":[{"vendor":"netty","product":"netty"}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/netty/netty/pull/17213","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/netty/netty/pull/17217","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75596.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-75596","tags":["advisory"]},{"url":"https://github.com/netty/netty","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24970.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","tags":["advisory"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","tags":["web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26017","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26018","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26586","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28573","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48124","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49700","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49701","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50085","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53644","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53645","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53646","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44249","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44249.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62260","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45416","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45416.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50010","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50010.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50010","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c653-97m9-rcg9","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75595.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264391-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275500","tags":["report"]},{"url":"https://bugzilla.suse.com/1275501","tags":["report"]},{"url":"https://bugzilla.suse.com/1276420","tags":["report"]},{"url":"https://bugzilla.suse.com/1276421","tags":["report"]},{"url":"https://bugzilla.suse.com/1276455","tags":["report"]},{"url":"https://bugzilla.suse.com/1276456","tags":["report"]},{"url":"https://bugzilla.suse.com/1277243","tags":["report"]},{"url":"https://bugzilla.suse.com/1280048","tags":["report"]},{"url":"https://bugzilla.suse.com/1281431","tags":["report"]},{"url":"https://bugzilla.suse.com/1281432","tags":["report"]},{"url":"https://bugzilla.suse.com/1281433","tags":["report"]},{"url":"https://bugzilla.suse.com/1281434","tags":["report"]},{"url":"https://bugzilla.suse.com/1281435","tags":["report"]},{"url":"https://bugzilla.suse.com/1282084","tags":["report"]},{"url":"https://bugzilla.suse.com/1282085","tags":["report"]},{"url":"https://bugzilla.suse.com/1282132","tags":["report"]},{"url":"https://bugzilla.suse.com/1282140","tags":["report"]},{"url":"https://bugzilla.suse.com/1282141","tags":["report"]},{"url":"https://bugzilla.suse.com/1282362","tags":["report"]},{"url":"https://bugzilla.suse.com/1282363","tags":["report"]},{"url":"https://bugzilla.suse.com/1282364","tags":["report"]},{"url":"https://bugzilla.suse.com/1282366","tags":["report"]},{"url":"https://bugzilla.suse.com/1282367","tags":["report"]},{"url":"https://bugzilla.suse.com/1282370","tags":["report"]},{"url":"https://bugzilla.suse.com/1282372","tags":["report"]},{"url":"https://bugzilla.suse.com/1282373","tags":["report"]},{"url":"https://bugzilla.suse.com/1282374","tags":["report"]},{"url":"https://bugzilla.suse.com/1282378","tags":["report"]},{"url":"https://bugzilla.suse.com/1282506","tags":["report"]},{"url":"https://bugzilla.suse.com/1282507","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93579","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-75596","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75596","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-75596","title":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T20:56:21.657Z","modified":"2026-08-20T19:59:14.152Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-63092","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T20:56:21Z","modified":"2026-08-20T19:59:14Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:38.32409Z"}],"ghsa":[{"id":"GHSA-fccg-mwvh-qqg4","title":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing","description":"### Summary\n\nNetty's default SNI entrypoint reparses and recopies previously received ClientHello fragments on every additional TLS handshake record. A remote peer can send a small first record that advertises a large ClientHello length and then drip the body in many tiny records, causing **superlinear (quadratic) CPU work** before the handshake completes. With 4095 one-byte fragments, the handler recopies **8,386,560 bytes** from only **24,579 bytes** on the wire — a **341× amplification** ratio.\n\n### Affected Entrypoints\n\n- `io.netty.handler.ssl.SniHandler` — default constructors\n- `io.netty.handler.ssl.SslClientHelloHandler` — pre-handshake ClientHello aggregation path\n\n### Vulnerable Code Locations\n\n- `handler/src/main/java/io/netty/handler/ssl/SniHandler.java:85`\n- `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:75` (decode entry)\n- `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:165` (handshakeBuffer.clear)\n- `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:174` (writeBytes re-copy)\n- `codec-base/src/main/java/io/netty/handler/codec/ByteToMessageDecoder.java:294` (cumulation retention)\n\n### Exploit Path\n\n```\n1. TCP connection → SniHandler → SslClientHelloHandler.decode\n2. First record: TLS handshake header declaring large ClientHello length (e.g., 4096 bytes)\n3. Attacker sends thousands of tiny follow-on handshake records (1 byte each)\n4. On each fragment: handshakeBuffer.clear() + writeBytes() re-copies ALL accumulated body bytes\n5. Total bytes copied = n*(n+1)/2 where n = number of body bytes → quadratic\n6. Event-loop CPU exhausted before SslHandler takes over\n```\n\n### Impact\n\n- **Vulnerability Type:** Inefficient Algorithmic Complexity\n- An unauthenticated network attacker can drive disproportionate CPU consumption on the Netty event loop\n- Affects **all** Netty deployments using `SniHandler` for TLS termination (the default SNI path)\n- No privileges, user interaction, or special configuration required\n- Can degrade or stall TLS connection handling for all clients on the affected event loop\n- The attack requires only modest bandwidth (~25 KB) to trigger significant CPU work\n\n---\n### Credits\n\nFound by a security research team from the University of Sydney, focusing on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/","status":"published","published":"2026-09-08T18:14:56Z","modified":"2026-09-08T18:14:57Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:41:13.477974Z"}],"nvd":[{"id":"CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T21:17:37.74Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T14:12:39.962615Z"}],"osv":[{"id":"CVE-2026-75596","title":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T20:56:21.657Z","modified":"2026-10-28T11:17:46.787451838Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T21:17:37.74Z","modified":"2026-10-27T09:47:37.977312228Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:03.004924Z"},{"id":"GHSA-fccg-mwvh-qqg4","title":"Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing","description":"### Summary\n\nNetty's default SNI entrypoint reparses and recopies previously received ClientHello fragments on every additional TLS handshake record. A remote peer can send a small first record that advertises a large ClientHello length and then drip the body in many tiny records, causing **superlinear (quadratic) CPU work** before the handshake completes. With 4095 one-byte fragments, the handler recopies **8,386,560 bytes** from only **24,579 bytes** on the wire — a **341× amplification** ratio.\n\n### Affected Entrypoints\n\n- `io.netty.handler.ssl.SniHandler` — default constructors\n- `io.netty.handler.ssl.SslClientHelloHandler` — pre-handshake ClientHello aggregation path\n\n### Vulnerable Code Locations\n\n- `handler/src/main/java/io/netty/handler/ssl/SniHandler.java:85`\n- `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:75` (decode entry)\n- `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:165` (handshakeBuffer.clear)\n- `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:174` (writeBytes re-copy)\n- `codec-base/src/main/java/io/netty/handler/codec/ByteToMessageDecoder.java:294` (cumulation retention)\n\n### Exploit Path\n\n```\n1. TCP connection → SniHandler → SslClientHelloHandler.decode\n2. First record: TLS handshake header declaring large ClientHello length (e.g., 4096 bytes)\n3. Attacker sends thousands of tiny follow-on handshake records (1 byte each)\n4. On each fragment: handshakeBuffer.clear() + writeBytes() re-copies ALL accumulated body bytes\n5. Total bytes copied = n*(n+1)/2 where n = number of body bytes → quadratic\n6. Event-loop CPU exhausted before SslHandler takes over\n```\n\n### Impact\n\n- **Vulnerability Type:** Inefficient Algorithmic Complexity\n- An unauthenticated network attacker can drive disproportionate CPU consumption on the Netty event loop\n- Affects **all** Netty deployments using `SniHandler` for TLS termination (the default SNI path)\n- No privileges, user interaction, or special configuration required\n- Can degrade or stall TLS connection handling for all clients on the affected event loop\n- The attack requires only modest bandwidth (~25 KB) to trigger significant CPU work\n\n---\n### Credits\n\nFound by a security research team from the University of Sydney, focusing on detecting open source software vulnerabilities.\nLiyi Zhou: https://lzhou1110.github.io/\nZiyue Wang: https://zyy0530.github.io/\nStrick: https://str1ckl4nd.github.io/\nMaurice: https://maurice.busystar.org/\nChenchen Yu: https://7thparkk.github.io/","status":"published","published":"2026-09-08T18:14:56Z","modified":"2026-09-08T18:27:48.113951573Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-407"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"RHLW-2026-313117b0cad7329e","title":"Lightwell Security Advisory: netty-handler 4.1.100.Final-rhlw-00001","description":"Red Hat Lightwell has released io.netty:netty-handler 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-24970, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-75595, and CVE-2026-75596.\n\nCVE-2025-24970: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine\n\nCVE-2026-44249: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking\n\nCVE-2026-45416: Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes\n\nCVE-2026-50010: Netty's wrapping plain trust manager silently disables hostname verification\n\nCVE-2026-75595: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext\n\nCVE-2026-75596: Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing\n\nThis patched artifact is a drop-in replacement for io.netty:netty-handler 4.1.100.Final from Maven Central.","status":"published","published":"2026-10-12T16:58:10Z","modified":"2026-10-27T04:13:04.191727203Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-75596","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T21:17:00Z","modified":"2026-10-17T13:01:05.164228692Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"CLSA-2026-1789214678","title":"TuxCare security update for io.netty:netty-handler (2 CVEs)","description":"TuxCare rebuilt io.netty:netty-handler to address 2 CVEs. Fixed in 4.1.122.Final-tuxcare.4.","status":"published","published":"2026-09-12T12:04:38Z","modified":"2026-11-02T19:46:14.33536631Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1789228568","title":"TuxCare security update for io.netty:netty-handler (2 CVEs)","description":"TuxCare rebuilt io.netty:netty-handler to address 2 CVEs. Fixed in 4.1.119.Final-tuxcare.3.","status":"published","published":"2026-09-12T15:56:08Z","modified":"2026-11-02T19:46:14.340218921Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1792115780","title":"TuxCare security update for io.netty (9 CVEs)","description":"TuxCare rebuilt 8 io.netty packages to address 9 CVEs. Fixed in 4.1.115.Final-tuxcare.9.","status":"published","published":"2026-10-16T01:56:20Z","modified":"2026-11-02T19:46:29.392948514Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792686520","title":"TuxCare security update for io.netty (24 CVEs)","description":"TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.114.Final-tuxcare.1.","status":"published","published":"2026-10-22T16:28:40Z","modified":"2026-11-02T19:46:30.908225231Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793707066","title":"TuxCare security update for io.netty (13 CVEs)","description":"TuxCare rebuilt 9 io.netty packages to address 13 CVEs. Fixed in 4.1.113.Final-tuxcare.2.","status":"published","published":"2026-11-03T12:57:47Z","modified":"2026-11-03T19:30:06.372744869Z","updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"openSUSE-SU-2026:11882-1","title":"netty-4.1.138-1.1 on GA media","description":"These are all security issues fixed in the netty-4.1.138-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:09.573141425Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"SUSE-SU-2026:4391-1","title":"Security update for netty, netty-tcnative","description":"This update for netty, netty-tcnative fixes the following issues:\n\n- CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501).\n- CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite\n  (bsc#1275500).\n- CVE-2026-62243: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455).\n- CVE-2026-62380: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456).\n- CVE-2026-75595: fragmented TLS `ClientHello` causes fallback to default `SslContext` and allows for SNI routing and\n  mTLS requirement bypass (bsc#1276420).\n- CVE-2026-75596: fragmented `ClientHello`records can trigger quadratic pre-handshake reassembly in default SNI parsing\n  (bsc#1276421).\n- CVE-2026-76816: missing input validation in `MqttEncoder` allows for null-byte injection, topic hijacking, and ACL\n  bypassing (bsc#1277243).\n- CVE-2026-89044: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding\n  (bsc#1280048).\n- CVE-2026-93488: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084).\n- CVE-2026-93491: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085).\n- CVE-2026-93492: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132).\n- CVE-2026-93493: missing `nextUpdate` field in OCSP responses leads to silent validation bypass (bsc#1281431).\n- CVE-2026-93494: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506).\n- CVE-2026-93558: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service\n  (bsc#1282140).\n- CVE-2026-93560: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141).\n- CVE-2026-93562: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362).\n- CVE-2026-93563: unbounded multi-line response accumulation in `SmtpResponseDecoder` leads to memory exhaustion and a\n  DoS (bsc#1281432).\n- CVE-2026-93564: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363).\n- CVE-2026-93565: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364).\n- CVE-2026-93566: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366).\n- CVE-2026-93567: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled\n  :authority (bsc#1282367).\n- CVE-2026-93568: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370).\n- CVE-2026-93569: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target\n  authority (bsc#1282372).\n- CVE-2026-93572: multiplication of patched preallocation limits in `RedisArrayAggregator` nested RESP headers can lead\n  to denial of service (bsc#1281433).\n- CVE-2026-93573: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373).\n- CVE-2026-93574: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374).\n- CVE-2026-93575: missing validations in the `MqttDecoder` can lead to excessive resource consumption and a DoS\n  (bsc#1281434).\n- CVE-2026-93576: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507).\n- CVE-2026-93578: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass\n  (bsc#1281435).\n- CVE-2026-93579: HTTP/2 header field values are not validated by default (bsc#1282378).\n\nChanges for netty:\n\n- Upgrade to upstream version 4.1.138\n\nChanges for netty-tcnative:\n\n- Upgrade to version 2.0.84 Final\n","status":"published","published":"2026-09-29T11:47:41Z","modified":"2026-09-30T12:00:04.604890726Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}