8.2
Élevée
CVE-2026-116541 Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO…
Description
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| netty-tcnative 2.0 | premières → < 2.0.84.Final | 2.0.84.Final |
| netty-tcnative-boringssl-static 2.0 | premières → < 2.0.84.Final | 2.0.84.Final |
Références
- GitHub Security Advisory (GHSA-9xr3-jwv4-r489) github.com
- Patch Commit github.com
- github.com github.com
- netty-tcnative netty-tcnative-parent-2.0.84.Final Release Notes github.com
- github.com github.com
- VulnCheck Advisory: netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de netty-tcnative
Les 4 CVE de netty-tcnative →
CVE-2026-116542
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote…
6.9
Moyenne
CVE-2026-116540
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in…
8.2
Élevée
CVE-2026-116539
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer…
8.2
Élevée