CVE-2026-75595

Received Received - Intake

TLS Handshake Header Bypass in Netty

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-75595

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.1.137.final (inc)
netty	netty	to 4.2.17.final (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

Attack-Flow Graph

Executive Summary

This vulnerability in Netty, a network application framework, involves a flaw in the SslClientHelloHandler where an incorrect offset check can cause an IndexOutOfBoundsException. This leads to selecting the wrong SSL context, potentially bypassing mutual TLS authentication if clientAuth is not properly enforced.

Detection Guidance

This vulnerability can be detected by checking the Netty version in use. If your system runs Netty versions prior to 4.1.137.Final or 4.2.17.Final, it is vulnerable. Commands like 'find / -name "netty*.jar" 2>/dev/null' or checking dependency files (e.g., Maven's pom.xml or Gradle's build.gradle) can help identify the version.

Impact Analysis

An unauthenticated attacker could bypass mutual TLS requirements, gaining unauthorized access to protected routes if the default SslContext uses clientAuth=NONE or OPTIONAL without additional verification. This could expose sensitive data or services.

Compliance Impact

This vulnerability could lead to unauthorized access, violating data protection requirements in GDPR and HIPAA. Non-compliance may result in legal penalties, reputational damage, and loss of trust due to compromised data integrity and confidentiality.

Mitigation Strategies

Upgrade Netty to version 4.1.137.Final or 4.2.17.Final or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-75595. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70