CVE-2026-116542Medium· 5.3▾ SunlitNetty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
io.netty:netty-tcnative < 2.0.84.Finalio.netty:netty-tcnative-boringssl-static < 2.0.84.FinalRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116539Medium· 5.9Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO
CVE-2026-116541Medium· 5.9netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount
CVE-2026-116540Medium· 5.9netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
CVE-2021-43797Medium· 6.5Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients
CVE-2021-37137High· 7.5The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage
CVE-2021-37136High· 7.5The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)