Read the docs
TI-2026-52905 Aliases CVE-2026-75595GHSA-c4c3-7fpv-j4q5

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Priority MEDIUM 41CWE-754Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Partial Red Hat: 7 fixed, 15 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00316 24th percentileScored 2026-11-07
Fix Partial netty (netty): 4.1.137.Final, 4.2.17.Finalio.netty:netty-handler (Maven): 4.2.17.Final, 4.1.137.FinalRed Hat: 7 advisoriesRed Hat: 7 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynettybefore 4.1.137.Final; 4.2.0.Final to before 4.2.17.Final4.1.137.Final, 4.2.17.FinalPatch availableCNA
—io.netty:netty-handler (Maven)4.2.0.Final to before 4.2.17.Final4.2.17.FinalPatch availableGHSA-c4c3-7fpv-j4q5
—io.netty:netty-handler (Maven)before 4.1.137.Final4.1.137.FinalPatch availableGHSA-c4c3-7fpv-j4q5
  • netty Vendornetty Affected before 4.1.137.Final; 4.2.0.Final to before 4.2.17.Final Fixed in 4.1.137.Final, 4.2.17.Final Patch available CNA
  • io.netty:netty-handler (Maven) Vendor— Affected 4.2.0.Final to before 4.2.17.Final Fixed in 4.2.17.Final Patch available GHSA-c4c3-7fpv-j4q5
  • io.netty:netty-handler (Maven) Vendor— Affected before 4.1.137.Final Fixed in 4.1.137.Final Patch available GHSA-c4c3-7fpv-j4q5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.137; 4.2.0 to before 4.2.17Vulnerablenetty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.137; 4.2.0 to before 4.2.17 Vulnerable ·netty

Remediation

  • Fix · CNA netty (netty) Fixed in 4.1.137.Final, 4.2.17.Final
  • Fix · GHSA-c4c3-7fpv-j4q5 io.netty:netty-handler (Maven) Fixed in 4.2.17.Final Advisory →
  • Fix · GHSA-c4c3-7fpv-j4q5 io.netty:netty-handler (Maven) Fixed in 4.1.137.Final Advisory →

Red Hat 7 advisories

  • RHSA-2026:95887 Released 2026-11-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.9 security update
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:95762 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.8 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:95760 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.17 Images Security Update
    • Red Hat build of Keycloak 26.4 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
Show 4 more Red Hat advisories
  • RHSA-2026:95761 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.8 Security Update
    • Red Hat build of Keycloak 26.6.8
  • RHSA-2026:95759 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.17 Security Update
    • Red Hat build of Keycloak 26.4.17
  • RHSA-2026:83612 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Debezium 3.6.3 release
    • Red Hat Build of Debezium 3.6
  • RHSA-2026:71675 Released 2026-09-24 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18.4 for Spring Boot release.
    • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffected—
OpenShift ServerlessAffected—
Red Hat AMQ ClientsAffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3Affected—
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat Offline Knowledge PortalAffected—
Red Hat OpenShift AI (RHOAI)Affected—
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat OpenStack Platform 13 (Queens)Affected—
Red Hat Satellite 6Affected—
Red Hat Single Sign-On 7AffectedNo fix planned: Out of support scope
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat Build of Debezium 3.6Fixed RHSA-2026:83612
Red Hat JBoss Enterprise Application Platform 8.1Fixed RHSA-2026:95887
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16Fixed RHSA-2026:71675
Red Hat build of Keycloak 26.4Fixed RHSA-2026:95760
Red Hat build of Keycloak 26.4.17Fixed RHSA-2026:95759
Red Hat build of Keycloak 26.6Fixed RHSA-2026:95762
Red Hat build of Keycloak 26.6.8Fixed RHSA-2026:95761
Not affected: 4 products
  • Red Hat AMQ Broker 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75595
  2. 2026-10-03 Alias added: GHSA-c4c3-7fpv-j4q5
  3. 2026-10-16 Fix available: RHSA-2026:83612 · Red Hat
  4. 2026-10-16 Fix available: Red Hat Build of Debezium 3.6 · Red Hat
  5. 2026-10-20 Affected versions changed · Red Hat
  6. 2026-10-26 Affected versions changed · Red Hat
  7. 2026-11-06 Fix available: RHSA-2026:95761 · Red Hat
  8. 2026-11-06 Fix available: Red Hat build of Keycloak 26.6.8 · Red Hat
  9. 2026-11-06 Fix available: RHSA-2026:95760 · Red Hat
  10. 2026-11-06 Fix available: RHSA-2026:95887 · Red Hat
  11. 2026-11-06 Fix available: RHSA-2026:95762 · Red Hat
  12. 2026-11-06 Fix available: RHSA-2026:95759 · Red Hat
  13. 2026-11-06 Fix available: Red Hat JBoss Enterprise Application Platform 8.1, Red Hat build of Keycloak 26.4, Red Hat build of Keycloak 26.4.17 +1 · Red Hat

References

Patch 4

Advisory 2

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences