SSL Configuration Flaw in Netty Network Application Framework
CVE-2026-75595
What is CVE-2026-75595?
The Netty Framework, an asynchronous event-driven network application framework, is susceptible to a flaw in the SslClientHelloHandler component. Prior to the releases 4.1.137.Final and 4.2.17.Final, a miscalculation in the TLS handshake header offset can lead to an IndexOutOfBoundsException. Consequently, this allows a ClientHello packet, if structured in a certain way, to manipulate the selection of the SSL context, causing the default SslContext to be selected instead of a per-SNI specific context. In instances where client authentication is mandatory but is misconfigured to accept non-authenticated connections, an attacker could exploit this vulnerability to bypass mutual TLS protections.
Affected Version(s)
netty < 4.1.137.Final < 4.1.137.Final
netty >= 4.2.0.Final, < 4.2.17.Final < 4.2.0.Final, 4.2.17.Final