CVE-2026-75595: Netty SNI routing bypass via fragmented TLS ClientHello

CVE-2026-75595 · Severity: critical · CVSS 9.1 · Published 2026-08-19

Netty is a widely-used Java networking library that handles TLS encryption for secure communications. A flaw in its TLS ClientHello parsing allows an attacker to bypass mutual TLS (mTLS) authentication by sending a specially fragmented TLS handshake. When mTLS is the sole security gate for a service route and the fallback configuration is permissive, an unauthenticated attacker can access protected resources.

Technologies: io.netty:netty-handler (Maven), Netty. Vendors: Maven, Netty.

Quick answers

Is CVE-2026-75595 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75595 being exploited in the wild.
How severe is CVE-2026-75595?
Critical severity, with a CVSS score of 9.1, published 19 August 2026.
Which products and versions are affected?
io.netty:netty-handler (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.17.Final.
Is there a fix for CVE-2026-75595?
Yes. io.netty:netty-handler (Maven): upgrade to 4.2.17.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75595 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-75595?
Check whether you run io.netty:netty-handler (Maven) or Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-handler (Maven): upgrade to 4.2.17.Final or later
    # set io.netty:netty-handler to 4.2.17.Final in your pom.xml or build.gradle

Technical details

The vulnerability exists in io.netty.handler.ssl.SslClientHelloHandler#decode, where the handshake header length guard checks the wrong offset and fails to account for the 5-byte TLS record header. When a record payload is smaller than 4 bytes, an IndexOutOfBoundsException is thrown and caught by a generic exception handler that invokes select(ctx, null), falling back to the default permissive SslContext. This permits bypass of per-SNI mTLS authentication only when: (1) mTLS enforcement relies solely on per-SNI SslContext with clientAuth=REQUIRE, (2) the default/fallback SslContext has clientAuth=NONE or OPTIONAL, and (3) no secondary peer-certificate verification exists at the application layer. The attack requires network access and no authentication. Patches are available in versions 4.1.137.Final and 4.2.17.Final.

Affected products

  • Netty netty-handler 4.1.0.Final through 4.1.136.Final, 4.2.0.Final through 4.2.16.Final

Identifiers

  • CVE-2026-75595
  • GHSA-c4c3-7fpv-j4q5

Timeline

  • 2026-08-07: disclosed: Published by Netty maintainers
  • 2026-08-19: patched: NVD publication date; patches released in versions 4.1.137.Final and 4.2.17.Final
  • 2026-09-08: advisory: GitHub Advisory Database publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.