Inefficient Algorithmic Complexity in Netty - CVE-2026-75596
Published: August 8, 2026 / Updated: August 21, 2026
Vulnerability identifier: #VU141318
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-75596
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in the default SNI parsing path when processing fragmented TLS ClientHello records before handshake completion. A remote attacker can send many tiny handshake fragments that advertise a large ClientHello length to cause a denial of service.
The issue can degrade or stall TLS connection handling for other clients on the affected event loop.
Affected software
Netty
IBM SPSS Analytic Server
IBM SPSS Analytic Server
How to mitigate CVE-2026-75596
Install security update from vendor's website.
Netty - addressed in versions 4.1.137, 4.2.17