Executive brief
Netty is a widely-used Java networking library that handles TLS encryption for secure communications. A flaw in its TLS ClientHello parsing allows an attacker to bypass mutual TLS (mTLS) authentication by sending a specially fragmented TLS handshake. When mTLS is the sole security gate for a service route and the fallback configuration is permissive, an unauthenticated attacker can access protected resources.
Technical details
The vulnerability exists in io.netty.handler.ssl.SslClientHelloHandler#decode, where the handshake header length guard checks the wrong offset and fails to account for the 5-byte TLS record header. When a record payload is smaller than 4 bytes, an IndexOutOfBoundsException is thrown and caught by a generic exception handler that invokes select(ctx, null), falling back to the default permissive SslContext. This permits bypass of per-SNI mTLS authentication only when: (1) mTLS enforcement relies solely on per-SNI SslContext with clientAuth=REQUIRE, (2) the default/fallback SslContext has clientAuth=NONE or OPTIONAL, and (3) no secondary peer-certificate verification exists at the application layer. The attack requires network access and no authentication. Patches are available in versions 4.1.137.Final and 4.2.17.Final.
Affected products
- Netty netty-handler 4.1.0.Final through 4.1.136.Final, 4.2.0.Final through 4.2.16.Final
Timeline
- 2026-08-07: disclosed: Published by Netty maintainers
- 2026-08-19: patched: NVD publication date; patches released in versions 4.1.137.Final and 4.2.17.Final
- 2026-09-08: advisory: GitHub Advisory Database publication