CVE-2026-75596: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.

CVE-2026-75596 · Severity: high · CVSS 7.5 · Published 2026-08-19

Netty's TLS Server Name Indication (SNI) handler processes fragmented TLS ClientHello messages inefficiently, re-copying previously received data on each new fragment. An attacker can exploit this by sending a TLS handshake that advertises a large message size followed by thousands of tiny fragments, forcing the server to waste CPU resources reassembling the same bytes repeatedly. This can exhaust event-loop capacity and starve legitimate TLS connections from being processed, causing service degradation or denial of service.

Technologies: io.netty:netty-handler (Maven), Netty. Vendors: Maven, Netty.

Quick answers

Is CVE-2026-75596 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75596 being exploited in the wild.
How severe is CVE-2026-75596?
High severity, with a CVSS score of 7.5, published 19 August 2026.
Which products and versions are affected?
io.netty:netty-handler (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.17.Final.
Is there a fix for CVE-2026-75596?
Yes. io.netty:netty-handler (Maven): upgrade to 4.2.17.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75596 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-75596?
Check whether you run io.netty:netty-handler (Maven) or Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-handler (Maven): upgrade to 4.2.17.Final or later
    # set io.netty:netty-handler to 4.2.17.Final in your pom.xml or build.gradle

Technical details

The vulnerability is an inefficient algorithmic complexity flaw (CWE-407) in Netty's TLS SNI and pre-handshake ClientHello handling. When `SniHandler` (default constructor) or `SslClientHelloHandler` receive fragmented TLS records advertising a large ClientHello, the code repeatedly clears and recopies accumulated message bytes on each new fragment via `handshakeBuffer.clear()` + `writeBytes()` operations. This results in O(n²) CPU work where n is the total message length. An unauthenticated network attacker can trigger this with minimal bandwidth (~25 KB) by sending a TLS record declaring 4096+ bytes of ClientHello followed by thousands of 1-byte fragments. The attack requires no privileges, authentication, or user interaction. Patches are available in netty-handler 4.1.137.Final and 4.2.17.Final.

Affected products

  • Netty netty-handler >= 4.2.0.Final, <= 4.2.16.Final; <= 4.1.136.Final

Identifiers

  • CVE-2026-75596
  • GHSA-fccg-mwvh-qqg4

Timeline

  • 2026-08-19: disclosed: Published to NVD
  • 2026: patched: Patches released: netty-4.1.137.Final, netty-4.2.17.Final
  • 2026-09-08: advisory: GitHub Security Advisory GHSA-fccg-mwvh-qqg4 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.