SB2026080807 - Multiple vulnerabilities in Netty

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080807

SB2026080807 - Multiple vulnerabilities in Netty

Published: August 8, 2026

Security Bulletin ID SB2026080807
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 86% Low 14%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Improper validation of certificate with host mismatch (CVE-ID: N/A)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass TLS hostname verification and disclose sensitive information.

The vulnerability exists due to improper validation of certificate with host mismatch in the OpenSSL client path when using a plain X509TrustManager and trust-manager wrapping is unavailable. A remote attacker can present a certificate for a mismatched hostname to bypass TLS hostname verification and disclose sensitive information.

This affects the SslProvider.OPENSSL path on Java 25+ when Unsafe-based reflection is unavailable and a non-extended X509TrustManager is used.


2) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the default SNI parsing path when processing fragmented TLS ClientHello records before handshake completion. A remote attacker can send many tiny handshake fragments that advertise a large ClientHello length to cause a denial of service.

The issue can degrade or stall TLS connection handling for other clients on the affected event loop.


3) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass mTLS requirements.

The vulnerability exists due to an incorrect offset check in io.netty.handler.ssl.SslClientHelloHandler#decode when parsing a fragmented TLS ClientHello whose handshake header spans multiple records. A remote attacker can send a specially crafted fragmented TLS ClientHello to bypass mTLS requirements.

This issue affects deployments where per-SNI SslContext selection is the only mTLS gate, the default SslContext is permissive, and no secondary peer-certificate verification exists at the application layer.


4) Resource exhaustion (CVE-ID: CVE-2026-59902)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in io.netty.handler.codec.sctp.SctpMessageCompletionHandler when buffering incomplete SCTP message fragments. A remote attacker can send large SCTP fragments to cause a denial of service.

By opening a small number of concurrent connections, memory consumption can grow until an OutOfMemoryError occurs.


5) Use of cache containing sensitive information (CVE-ID: CVE-2026-59903)

CWE-ID: CWE-524 - Use of Cache Containing Sensitive Information

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of cache containing sensitive information in io.netty.handler.codec.http.cors.CorsHandler#setVaryHeader when handling responses behind a caching proxy or CDN. A remote attacker can trigger caching of user-specific responses with an overwritten Vary header to disclose sensitive information.

This affects Netty-based web applications that use CorsHandler, set their own Vary headers for authenticated or user-specific responses, and are deployed behind an intermediate cache.


6) Null Byte Interaction Error (Poison Null Byte) (CVE-ID: N/A)

CWE-ID: CWE-626 - Null Byte Interaction Error (Poison Null Byte)

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to spoof domains and inject authentication data.

The vulnerability exists due to null byte interaction error in Socks4ClientEncoder and Socks5ClientEncoder when encoding SOCKS4 or SOCKS5 fields containing embedded null bytes or control characters. A remote attacker can supply specially crafted domain names, user identifiers, usernames, or passwords to spoof domains and inject authentication data.

Different proxy implementations may truncate null-terminated values differently, which can cause protocol ambiguity in SOCKS4 and altered interpretation of SOCKS5 destination and credential fields.


7) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass topic or client identifier validation.

The vulnerability exists due to improper input validation in io.netty.handler.codec.mqtt.MqttEncoder when encoding MQTT topic names, client IDs, usernames, and passwords as UTF-8 strings. A remote user can supply crafted MQTT string values containing prohibited characters to bypass topic or client identifier validation.

Exploitation requires an application to use Netty\'s MQTT codec-mqtt support with user-controlled input in MQTT string fields.


Remediation

Install update from vendor's website.

References