CVE-2026-75595

Netty is an asynchronous, event-driven network application framework.

Netty

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE…

19. Aug 2026

Ausgewertete Quellen

• NVD
  CVE-2026-75595
• GitHub
  https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5