Read the docs
TI-2026-52906 Aliases CVE-2026-75596GHSA-fccg-mwvh-qqg4

Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

Priority MEDIUM 44CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-407.

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00374 31st percentileScored 2026-11-07
Fix Fixed netty (netty): 4.1.137.Final, 4.2.17.Finalio.netty:netty-handler (Maven): 4.2.17.Final, 4.1.137.Final

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynettybefore 4.1.137.Final; 4.2.0.Final to before 4.2.17.Final4.1.137.Final, 4.2.17.FinalPatch availableCNA
—io.netty:netty-handler (Maven)4.2.0.Final to before 4.2.17.Final4.2.17.FinalPatch availableGHSA-fccg-mwvh-qqg4
—io.netty:netty-handler (Maven)before 4.1.137.Final4.1.137.FinalPatch availableGHSA-fccg-mwvh-qqg4
  • netty Vendornetty Affected before 4.1.137.Final; 4.2.0.Final to before 4.2.17.Final Fixed in 4.1.137.Final, 4.2.17.Final Patch available CNA
  • io.netty:netty-handler (Maven) Vendor— Affected 4.2.0.Final to before 4.2.17.Final Fixed in 4.2.17.Final Patch available GHSA-fccg-mwvh-qqg4
  • io.netty:netty-handler (Maven) Vendor— Affected before 4.1.137.Final Fixed in 4.1.137.Final Patch available GHSA-fccg-mwvh-qqg4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.137; 4.2.0 to before 4.2.17Vulnerablenetty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.137; 4.2.0 to before 4.2.17 Vulnerable ·netty

Remediation

  • Fix · CNA netty (netty) Fixed in 4.1.137.Final, 4.2.17.Final
  • Fix · GHSA-fccg-mwvh-qqg4 io.netty:netty-handler (Maven) Fixed in 4.2.17.Final Advisory →
  • Fix · GHSA-fccg-mwvh-qqg4 io.netty:netty-handler (Maven) Fixed in 4.1.137.Final Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-75596
  2. 2026-10-03 Alias added: GHSA-fccg-mwvh-qqg4

References

Patch 4

Advisory 2

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences