# CVE-2026-75596: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.

Source: https://junglewise.ai/threats/cve-2026-75596-netty-quadratic-pre-handshake-clienthello-reassembly-in-sni  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-75596 · Severity: high · CVSS 7.5 · Published 2026-08-19

Netty's TLS Server Name Indication (SNI) handler processes fragmented TLS ClientHello messages inefficiently, re-copying previously received data on each new fragment. An attacker can exploit this by sending a TLS handshake that advertises a large message size followed by thousands of tiny fragments, forcing the server to waste CPU resources reassembling the same bytes repeatedly. This can exhaust event-loop capacity and starve legitimate TLS connections from being processed, causing service degradation or denial of service.

Technologies: [io.netty:netty-handler (Maven)](https://junglewise.ai/threats/technologies/io-netty-netty-handler), [Netty](https://junglewise.ai/threats/technologies/netty). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Netty](https://junglewise.ai/threats/vendors/netty).

## Quick answers

**Is CVE-2026-75596 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-75596 being exploited in the wild.

**How severe is CVE-2026-75596?** High severity, with a CVSS score of 7.5, published 19 August 2026.

**Which products and versions are affected?** io.netty:netty-handler (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.17.Final.

**Is there a fix for CVE-2026-75596?** Yes. io.netty:netty-handler (Maven): upgrade to 4.2.17.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-75596 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-75596?** Check whether you run io.netty:netty-handler (Maven) or Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- io.netty:netty-handler (Maven): upgrade to 4.2.17.Final or later

  ```sh
  # set io.netty:netty-handler to 4.2.17.Final in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is an inefficient algorithmic complexity flaw (CWE-407) in Netty's TLS SNI and pre-handshake ClientHello handling. When `SniHandler` (default constructor) or `SslClientHelloHandler` receive fragmented TLS records advertising a large ClientHello, the code repeatedly clears and recopies accumulated message bytes on each new fragment via `handshakeBuffer.clear()` + `writeBytes()` operations. This results in O(n²) CPU work where n is the total message length. An unauthenticated network attacker can trigger this with minimal bandwidth (~25 KB) by sending a TLS record declaring 4096+ bytes of ClientHello followed by thousands of 1-byte fragments. The attack requires no privileges, authentication, or user interaction. Patches are available in netty-handler 4.1.137.Final and 4.2.17.Final.

## Affected products

- Netty netty-handler >= 4.2.0.Final, <= 4.2.16.Final; <= 4.1.136.Final

## Identifiers

- CVE-2026-75596
- GHSA-fccg-mwvh-qqg4

## Timeline

- 2026-08-19: disclosed: Published to NVD
- 2026: patched: Patches released: netty-4.1.137.Final, netty-4.2.17.Final
- 2026-09-08: advisory: GitHub Security Advisory GHSA-fccg-mwvh-qqg4 published

## References

- [https://api.github.com/users/mauriceng98](https://api.github.com/users/mauriceng98)
- [https://github.com/mauriceng98](https://github.com/mauriceng98)
- [https://api.github.com/users/mauriceng98/gists%7B/gist_id%7D](https://api.github.com/users/mauriceng98/gists%7B/gist_id%7D)
- [https://api.github.com/users/mauriceng98/repos](https://api.github.com/users/mauriceng98/repos)
- [https://avatars.githubusercontent.com/u/97803816?v=4](https://avatars.githubusercontent.com/u/97803816?v=4)
- [https://api.github.com/users/mauriceng98/events%7B/privacy%7D](https://api.github.com/users/mauriceng98/events%7B/privacy%7D)

## Related threats

- [Netty HTTP/1 decoder request smuggling](https://junglewise.ai/threats/cve-2026-93562-a-flaw-was-found-in-netty-s-http-1-decoder-incomplete-validation)
- [Netty HTTP/1 to HTTP/2 conversion authority mismatch](https://junglewise.ai/threats/cve-2026-93569-netty-http-1-to-http-2-conversion-authority-mismatch)
- [Netty HTTP request smuggling via control characters in chunk size](https://junglewise.ai/threats/cve-2026-93566-netty-http-request-smuggling-via-control-characters-in-chunk-size)
- [Netty RtspDecoder method-token smuggling in RTSP parsing](https://junglewise.ai/threats/cve-2026-93565-netty-rtspdecoder-method-token-smuggling-in-rtsp-parsing)
- [Netty reference-count leak in HAProxy PROXY-v2 decoder](https://junglewise.ai/threats/cve-2026-93564-netty-reference-count-leak-in-haproxy-proxy-v2-decoder)