Heap Buffer Overflow Vulnerability in Netty tcnative by Netty

CVE-2026-116539

What is CVE-2026-116539?

A heap buffer overflow flaw exists in the Netty tcnative library prior to version 2.0.84.Final. This vulnerability arises in the tcn_write_to_bytebuffer BIO callback due to improper handling of the non-application ring buffer write index. By exploiting this issue, remote TLS peers may cause the library to mishandle handshake, renegotiation, or post-handshake messages, leading to an out-of-bounds memcpy operation. This can result in a Java Virtual Machine (JVM) crash, exposing systems reliant on this library to potential disruption.

References