Network Application Framework Vulnerability in Netty
CVE-2026-75596
8.7HIGH
What is CVE-2026-75596?
A vulnerability in Netty's asynchronous network application framework allows an unauthenticated remote peer to exploit the ClientHello message during the TLS handshake. The default SniHandler constructors are affected due to the handling of large ClientHello messages in multiple small records, leading to excessive CPU usage in the event loop. This results in degraded TLS handling for other clients before the handshake is complete. The problem has been addressed in Netty versions 4.1.137.Final and 4.2.17.Final.
Affected Version(s)
netty < 4.1.137.Final < 4.1.137.Final
netty >= 4.2.0.Final, < 4.2.17.Final < 4.2.0.Final, 4.2.17.Final