Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: netty-tcnative 2.0.84.Final Clear all filters
TI-2026-80459 CVE-2026-116542 · GHSA-98m4-7wj9-fxmw

SNI hostname spoofing in Netty netty-tcnative via UTF-8 decoding

Priority HIGH 70

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00208 Published 2026-10-26 Partial fix · 2.0.84.Final CWE-176
TI-2026-80458 CVE-2026-116541 · GHSA-rm79-885g-92ch

Denial of service in Netty netty-tcnative via BIO write overcount

Priority LOW 36

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00493 Published 2026-10-26 Partial fix · 2.0.84.Final CWE-682
TI-2026-80457 CVE-2026-116540 · GHSA-fgcj-53j7-r6vq

Use-after-free in netty-tcnative session ticket key callback

Priority LOW 36

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00459 Published 2026-10-26 Partial fix · 2.0.84.Final CWE-416
TI-2026-80456 CVE-2026-116539 · GHSA-22qq-f4wc-4vfx

Heap buffer overflow in Netty netty-tcnative via OpenSSL BIO

Priority HIGH 75

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00396 Published 2026-10-26 Partial fix · 2.0.84.Final CWE-787