Inefficient Algorithmic Complexity in Netty - #VU141318
Published: August 8, 2026
Vulnerability identifier: #VU141318
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in the default SNI parsing path when processing fragmented TLS ClientHello records before handshake completion. A remote attacker can send many tiny handshake fragments that advertise a large ClientHello length to cause a denial of service.
The issue can degrade or stall TLS connection handling for other clients on the affected event loop.
Affected software
Netty
Remediation
Install security update from vendor's website.
Netty - addressed in versions 4.1.137, 4.2.17