Executive brief
Netty is a widely used networking framework for building high-performance servers and clients. A vulnerability in its TLS handling component allows an attacker to force the server to allocate large amounts of memory using very small network requests. This can lead to a denial-of-service (DoS) condition where the server runs out of memory and crashes or becomes unresponsive, disrupting business operations.
Technical details
A resource exhaustion vulnerability exists in Netty's SslClientHelloHandler.decode() due to improper validation of the TLS handshake length. When using common SniHandler or AbstractSniHandler constructors, the 'maxClientHelloLength' guard is disabled (set to 0), allowing the handler to eagerly allocate a buffer based on the 24-bit handshake length provided in the ClientHello. An attacker can send a small request (as few as nine bytes) that specifies a 16 MiB handshake length, forcing an immediate unpooled memory allocation that is retained until the channel closes. This can be exploited remotely without authentication to exhaust server memory. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final by implementing sane default limits for ClientHello length and timeouts.
Affected products
- Netty netty-handler < 4.1.135.Final, 4.2.0.Final - 4.2.14.Final
Timeline
- 2026-06-02: patched: Versions 4.1.135.Final and 4.2.15.Final released
- 2026-06-05: advisory: GitHub Security Advisory GHSA-x4gw-5cx5-pgmh published
- 2026-06-12: disclosed: NVD publication date