Read the docs
TI-2026-80458 Aliases CVE-2026-116541GHSA-rm79-885g-92ch

Denial of service in Netty netty-tcnative via BIO write overcount

Priority LOW 36CWE-682Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

netty-tcnative and netty-tcnative-boringssl-static before 2.0.84.Final are affected. An incorrect calculation in the tcn_write_to_bytebuffer BIO write callback overreports the bytes consumed (CWE-682). A remote TLS 1.3 peer can trigger queued post-handshake records such as NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00493 42nd percentileScored 2026-11-07
Fix Partial netty-tcnative (netty): 2.0.84.Finalnetty-tcnative-boringssl-static (netty): 2.0.84.FinalRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty-tcnativebefore 2.0.84.Final2.0.84.FinalPatch availableCNA
nettynetty-tcnative-boringssl-staticbefore 2.0.84.Final2.0.84.FinalPatch availableCNA
  • netty-tcnative Vendornetty Affected before 2.0.84.Final Fixed in 2.0.84.Final Patch available CNA
  • netty-tcnative-boringssl-static Vendornetty Affected before 2.0.84.Final Fixed in 2.0.84.Final Patch available CNA

Remediation

Upgrade netty-tcnative and netty-tcnative-boringssl-static to 2.0.84.Final. The sources list no fixed version for Red Hat Fuse 7 (no fix planned) or for Red Hat build of Apache Camel for Spring Boot 4 (none available).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA netty-tcnative (netty) Fixed in 2.0.84.Final
  • Fix · CNA netty-tcnative-boringssl-static (netty) Fixed in 2.0.84.Final

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    netty-tcnative 2.0.84.Final

    4 records Highest priority Priority HIGH 2 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2026-80456 Heap buffer overflow in Netty netty-tcnative via OpenSSL BIOPriority HIGH 75
    • TI-2026-80459 SNI hostname spoofing in Netty netty-tcnative via UTF-8 decodingPriority HIGH 70
    • TI-2026-80457 Use-after-free in netty-tcnative session ticket key callbackPriority LOW 36
    Show all 4 records →
  • Release ·

    netty-tcnative-boringssl-static 2.0.84.Final

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-80456 Heap buffer overflow in Netty netty-tcnative via OpenSSL BIOPriority HIGH 75
    • TI-2026-80459 SNI hostname spoofing in Netty netty-tcnative via UTF-8 decodingPriority HIGH 70
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116541
  2. 2026-10-26 CISA SSVC decision points changed
  3. 2026-10-26 Priority changed: MEDIUM → LOW
  4. 2026-10-27 Alias added: GHSA-rm79-885g-92ch
  5. 2026-11-04 Affected versions changed · Red Hat
  6. 2026-11-04 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVSS 4.0HIGH 8.7
  • TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVSS 4.0HIGH 8.7
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences