Read the docs
TI-2026-80456 Aliases CVE-2026-116539GHSA-22qq-f4wc-4vfx

Heap buffer overflow in Netty netty-tcnative via OpenSSL BIO

Priority HIGH 75CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.

Summary

netty-tcnative and netty-tcnative-boringssl-static before 2.0.84.Final contain a heap buffer overflow in the tcn_write_to_bytebuffer BIO callback, caused by a missing wrap of the non-application ring buffer write index (CWE-787). A remote TLS peer can drive handshake, renegotiation or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Fix Partial netty-tcnative (netty): 2.0.84.Finalnetty-tcnative-boringssl-static (netty): 2.0.84.FinalRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty-tcnativebefore 2.0.84.Final2.0.84.FinalPatch availableCNA
nettynetty-tcnative-boringssl-staticbefore 2.0.84.Final2.0.84.FinalPatch availableCNA
  • netty-tcnative Vendornetty Affected before 2.0.84.Final Fixed in 2.0.84.Final Patch available CNA
  • netty-tcnative-boringssl-static Vendornetty Affected before 2.0.84.Final Fixed in 2.0.84.Final Patch available CNA

Remediation

Upgrade netty-tcnative and netty-tcnative-boringssl-static to 2.0.84.Final. The sources list no fixed version for Red Hat Fuse 7 (no fix planned) or the Red Hat build of Apache Camel for Spring Boot 4 (none available).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA netty-tcnative (netty) Fixed in 2.0.84.Final
  • Fix · CNA netty-tcnative-boringssl-static (netty) Fixed in 2.0.84.Final

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    netty-tcnative 2.0.84.Final

    4 records Highest priority Priority HIGH 2 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2026-80459 SNI hostname spoofing in Netty netty-tcnative via UTF-8 decodingPriority HIGH 70
    • TI-2026-80458 Denial of service in Netty netty-tcnative via BIO write overcountPriority LOW 36
    • TI-2026-80457 Use-after-free in netty-tcnative session ticket key callbackPriority LOW 36
    Show all 4 records →
  • Release ·

    netty-tcnative-boringssl-static 2.0.84.Final

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-80459 SNI hostname spoofing in Netty netty-tcnative via UTF-8 decodingPriority HIGH 70
    • TI-2026-80458 Denial of service in Netty netty-tcnative via BIO write overcountPriority LOW 36
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116539
  2. 2026-10-27 Alias added: GHSA-22qq-f4wc-4vfx
  3. 2026-10-27 Priority changed: MEDIUM → LOW
  4. 2026-11-02 CISA SSVC decision points changed
  5. 2026-11-02 Priority changed: LOW → HIGH
  6. 2026-11-04 Affected versions changed · Red Hat
  7. 2026-11-04 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVSS 4.0HIGH 8.7
  • TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVSS 4.0HIGH 8.7
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences