SNI Hostname Spoofing Vulnerability in Netty tcnative by Netty
CVE-2026-116542

6.9MEDIUM

Key Information:

Vendor

Netty

Status
Netty-tcnative
Netty-tcnative-boringssl-static
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116542?

Netty tcnative prior to version 2.0.84.Final is vulnerable to an SNI hostname spoofing issue that can be exploited by remote unauthenticated clients. The vulnerability arises when attackers craft overly long encodings, such as 0xC0 0x80, in the ClientHello 'server_name' field. This manipulation can confuse SNI-based certificate selection, leading to incorrect access decisions and impact logging accuracy. Users are encouraged to update to the patched version to mitigate the risks associated with this vulnerability.

Affected Version(s)

netty-tcnative 0 < 2.0.84.Final

netty-tcnative-boringssl-static 0 < 2.0.84.Final

References

https://github.com/netty/netty-tcnative/security/advisori...
vendor-advisory
https://github.com/netty/netty-tcnative/commit/a879c85b97...
patch
https://github.com/netty/netty-tcnative/blob/netty-tcnati...
technical-description

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yu Bao, PayPal Cyber Security Team
.