Denial of Service Vulnerability in Netty tcnative from Netty
CVE-2026-116541

8.2HIGH

Key Information:

Vendor

Netty

Status
Netty-tcnative
Netty-tcnative-boringssl-static
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116541?

A denial of service vulnerability exists in Netty's netty-tcnative prior to version 2.0.84.Final. This vulnerability arises from the improper handling of the tcn_write_to_bytebuffer BIO write callback, which leads to an overreporting of bytes consumed. Remote peers utilizing TLS 1.3 can exploit this flaw to trigger issues such as truncated flights for queued post-handshake records, including NewSessionTicket or KeyUpdate. This may result in failed connections or could potentially abort the Java Virtual Machine (JVM) process, compromising application performance and reliability.

Affected Version(s)

netty-tcnative 0 < 2.0.84.Final

netty-tcnative-boringssl-static 0 < 2.0.84.Final

References

https://github.com/netty/netty-tcnative/security/advisori...
vendor-advisory
https://github.com/netty/netty-tcnative/commit/e31df4a588...
patch
https://github.com/netty/netty-tcnative/blob/netty-tcnati...
technical-description

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao, PayPal Cyber Security Team
.