Heap Buffer Overflow in Netty netty-tcnative

Executive Summary

CVE-2026-116539 is a heap buffer overflow vulnerability in Netty's netty-tcnative library before version 2.0.84.Final. It occurs in the tcn_write_to_bytebuffer BIO callback due to improper handling of the non-application ring buffer write index. Remote TLS peers can exploit this by sending handshake, renegotiation, or post-handshake messages, causing an out-of-bounds memcpy that crashes the JVM process.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the version of netty-tcnative in use. Compare your installed version against 2.0.84.Final or later. Commands like 'find / -name "netty-tcnative*.jar" 2>/dev/null' or checking dependency files (pom.xml, build.gradle) can help identify the version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial-of-service conditions by crashing the JVM process. In severe cases, it may lead to arbitrary memory corruption or heap memory disclosure. Attackers can exploit it remotely via TLS connections without requiring local access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade netty-tcnative to version 2.0.84.Final or later immediately. If upgrading is not possible, disable TLS renegotiation or post-handshake messages as a temporary workaround. Review SSL/TLS configurations to ensure nonApplicationBufferSize is set to a safe value.

Useful 0 Not Useful 0