---
id: CVE-2026-75595
title: 'Netty is an asynchronous, event-driven network application framework'
summary: >-
  Netty is an asynchronous, event-driven network application framework. Prior to
  4.1.137.Fina and 4.2.17.Final,
  io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset
  before reading the four-byte TLS handshake header, so…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-754
  - CWE-475
  - CWE-823
vendor: netty
product: netty
affected:
  - netty < 4.1.137
  - 'netty >= 4.2.0, < 4.2.17'
patched:
  - netty 4.2.17
published: '2026-08-19'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T19:33:26.833'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75595'
references:
  - url: >-
      https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7
    label: security-advisories@github.com
  - url: >-
      https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/pull/17213'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/pull/17217'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.1.137.Final'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/releases/tag/netty-4.2.17.Final'
    label: security-advisories@github.com
  - url: 'https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75595'
  - url: 'https://github.com/advisories/GHSA-c4c3-7fpv-j4q5'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75595.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-75595'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2519953'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-75595'
tags:
  - nvd
  - ghsa
  - maven
  - csaf
  - vex
  - red-hat
epss: 0.00282
epssPercentile: 0.20926
aliases:
  - GHSA-c4c3-7fpv-j4q5
ecosystem: maven
scores:
  nvd: 9.1
  vendor: 7.4
ingestedAt: '2026-09-08T19:08:49.635Z'
---

## Overview

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

## Affected

- `netty < 4.1.137`
- `netty >= 4.2.0, < 4.2.17`

## Remediation

Upgrade past the affected range:

- `netty 4.2.17`

## Package advisory (CVE-2026-75595)

Affected packages:

- `io.netty:netty-handler >= 4.2.0.Final, <= 4.2.16.Final`
- `io.netty:netty-handler <= 4.1.136.Final`

Patched in:

- `io.netty:netty-handler 4.2.17.Final`
- `io.netty:netty-handler 4.1.137.Final`

Source: https://github.com/advisories/GHSA-c4c3-7fpv-j4q5

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat AMQ Clients, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, Red Hat Ceph Storage 9, … · no fix planned: Red Hat Fuse 7, Red Hat Single Sign-On 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat AMQ Clients, … · updated 2026-09-22 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-75595.json)