CVE-2026-116542
Awaiting Analysis Awaiting Analysis - Queue

Netty SNI Hostname Spoofing via JNI NewStringUTF Decoding

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulnCheck

Description
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116542
EUVD
EUVD-2026-109912

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
netty netty-tcnative 0
netty netty-tcnative-boringssl-static 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-176 The product does not properly handle when an input contains Unicode encoding.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an SNI hostname spoofing issue in Netty netty-tcnative before version 2.0.84.Final. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name field to confuse SNI-based certificate selection and access decisions. The issue arises because netty-tcnative uses JNI's NewStringUTF() function, which decodes modified UTF-8 and incorrectly embeds NUL characters into Java hostname strings.

Detection Guidance

To detect this vulnerability, inspect network traffic for ClientHello messages containing overlong SNI encodings like 0xC0 0x80. Use packet capture tools such as Wireshark or tcpdump to analyze TLS handshakes. Check if your netty-tcnative version is below 2.0.84.Final.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to manipulate hostnames used for SNI-based access control. This could lead to incorrect virtual host or certificate selection, bypassing security measures. Attackers might access unauthorized resources or bypass logging mechanisms by exploiting this flaw.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access to sensitive data, potentially violating confidentiality requirements in GDPR and HIPAA. Incorrect access control decisions may lead to unauthorized data exposure or processing, which could result in regulatory penalties or breaches of compliance standards.

Mitigation Strategies

Upgrade netty-tcnative to version 2.0.84.Final or later. If using netty-tcnative-boringssl-static, upgrade to 2.0.84.Final. Apply patches from the official repository and verify the fix by testing SNI handling with malicious payloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116542. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart