Netty prior 4.1.137.Final/4.2.17.Final SslClientHelloHandler SslClientHelloHandler.java io.netty.handler.ssl.SslClientHelloHandler.decode out-of-bounds

Summaryinfo

A vulnerability categorized as critical has been discovered in Netty. This affects the function io.netty.handler.ssl.SslClientHelloHandler.decode of the file SslClientHelloHandler.java of the component SslClientHelloHandler. The manipulation results in out-of-bounds. This vulnerability is known as CVE-2026-75595. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in Netty. It has been classified as critical. Affected is the function io.netty.handler.ssl.SslClientHelloHandler.decode of the file SslClientHelloHandler.java of the component SslClientHelloHandler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-75595 since 08/18/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 4.1.137.Final or 4.2.17.Final eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Netty

Website

• Product: https://github.com/netty/netty/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion