CVE-2026-116542 in netty-tcnative
Summary
by MITRE • 10/26/2026
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Netty netty-tcnative prior to version 2.0.84.Final represents a critical flaw within the Secure Network Extensions implementation that handles Server Name Indication during TLS handshakes. This issue stems from improper validation of input data passed through the Java Native Interface, specifically involving the NewStringUTF decoding mechanism. When a remote client initiates a connection, it may include a server_name extension in its ClientHello message to indicate the hostname for which it requests a certificate. The netty-tcnative library is responsible for parsing this extension and converting the raw bytes into a usable string format for subsequent processing by the underlying OpenSSL libraries or application logic.
The core technical flaw lies in how the JNI NewStringUTF function processes byte sequences that do not conform to standard UTF-8 encoding rules. Specifically, attackers can exploit this by sending overlong encodings, such as the sequence 0xC0 followed by 0x80, within the SNI field. In valid UTF-8, these bytes are either invalid or represent a character in a way that differs from their literal interpretation when processed incorrectly. By crafting maliciously encoded hostnames, an attacker can cause the decoding process to produce unexpected results, effectively allowing them to spoof or alter the perceived hostname of the connection request without proper authentication.
This capability has significant operational impacts on security controls that rely heavily on SNI for decision-making processes. Many modern web servers and load balancers use the SNI value to select the appropriate SSL/TLS certificate from a pool of available certificates, ensuring that clients receive the correct identity verification material. If an attacker can manipulate this hostname via encoding tricks, they may force the server to present a certificate intended for a different domain or service. This undermines mutual authentication mechanisms and can lead to man-in-the-middle scenarios where trust boundaries are blurred. Furthermore, logging systems often record the SNI value as part of access logs; spoofing these values allows attackers to obfuscate their true target or activity pattern, complicating forensic analysis and incident response efforts.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to adequately sanitize or validate the byte sequences received from untrusted sources before processing them into strings. It also relates to CWE-758 Reliance on Undefined, Unspecified, or External Components, given that the flaw arises from how native code interacts with Java-level inputs in a manner not strictly governed by expected encoding standards. In terms of offensive security tactics, this technique corresponds to ATT&CK T1078 Valid Accounts and potentially T1496 Host-Based Proxying if used to redirect traffic or impersonate internal services, although the primary vector is more closely aligned with input validation failures leading to logic bypasses in network protocols.
To mitigate this risk, organizations running Netty netty-tcnative must upgrade immediately to version 2.0.84.Final or later, where the decoding logic has been hardened to reject malformed UTF-8 sequences and enforce stricter compliance with RFC standards for TLS extensions. For environments that cannot patch instantly due to dependency constraints, implementing a reverse proxy in front of Netty-based services can provide an additional layer of defense by validating SNI fields before they reach the vulnerable component. Security teams should also monitor logs for anomalous patterns involving unusual byte sequences or unexpected certificate selections, as these may indicate active exploitation attempts targeting this specific decoding flaw.