Read the docs
TI-2026-80459 Aliases CVE-2026-116542GHSA-98m4-7wj9-fxmw

SNI hostname spoofing in Netty netty-tcnative via UTF-8 decoding

Priority HIGH 70CWE-176Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Netty netty-tcnative before 2.0.84.Final and netty-tcnative-boringssl-static before 2.0.84.Final contain an SNI hostname spoofing flaw. JNI NewStringUTF decoding accepts overlong UTF-8 encodings in the server name, an improper handling of Unicode encoding (CWE-176). A remote unauthenticated client can alter the hostname used for SNI-based certificate selection, access decisions and logging.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00208 11th percentileScored 2026-11-07
Fix Partial netty-tcnative (netty): 2.0.84.Finalnetty-tcnative-boringssl-static (netty): 2.0.84.FinalRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty-tcnativebefore 2.0.84.Final2.0.84.FinalPatch availableCNA
nettynetty-tcnative-boringssl-staticbefore 2.0.84.Final2.0.84.FinalPatch availableCNA
  • netty-tcnative Vendornetty Affected before 2.0.84.Final Fixed in 2.0.84.Final Patch available CNA
  • netty-tcnative-boringssl-static Vendornetty Affected before 2.0.84.Final Fixed in 2.0.84.Final Patch available CNA

Remediation

Upgrade netty-tcnative and netty-tcnative-boringssl-static to 2.0.84.Final. Red Hat lists Red Hat Fuse 7 with no fix planned and Red Hat build of Apache Camel for Spring Boot 4 with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA netty-tcnative (netty) Fixed in 2.0.84.Final
  • Fix · CNA netty-tcnative-boringssl-static (netty) Fixed in 2.0.84.Final

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    netty-tcnative 2.0.84.Final

    4 records Highest priority Priority HIGH 2 HIGH, 2 LOW

    Other records, highest priority first

    • TI-2026-80456 Heap buffer overflow in Netty netty-tcnative via OpenSSL BIOPriority HIGH 75
    • TI-2026-80458 Denial of service in Netty netty-tcnative via BIO write overcountPriority LOW 36
    • TI-2026-80457 Use-after-free in netty-tcnative session ticket key callbackPriority LOW 36
    Show all 4 records →
  • Release ·

    netty-tcnative-boringssl-static 2.0.84.Final

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-80456 Heap buffer overflow in Netty netty-tcnative via OpenSSL BIOPriority HIGH 75
    • TI-2026-80458 Denial of service in Netty netty-tcnative via BIO write overcountPriority LOW 36
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116542
  2. 2026-10-27 Alias added: GHSA-98m4-7wj9-fxmw
  3. 2026-10-27 Priority changed: MEDIUM → LOW
  4. 2026-10-31 CISA SSVC decision points changed
  5. 2026-10-31 Priority changed: LOW → HIGH
  6. 2026-11-04 Affected versions changed · Red Hat
  7. 2026-11-04 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-64821 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVSS 4.0HIGH 8.7
  • TI-2026-64818 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVSS 4.0HIGH 8.7
See all 114 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences