CVE-2026-75596

Received Received - Intake

Denial of Service in Netty TLS Handshake

Publication date: 2026-08-19

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-20

Generated

2026-09-09

AI Q&A

2026-08-20

EPSS Evaluated

2026-09-07

NVD

CVE-2026-75596

Affected Vendors & Products

Vendor	Product	Version / Range
netty	netty	to 4.1.137.Final\|end_excluding=4.2.17.Final (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability in Netty involves a flaw in the default SniHandler constructors where handshakeBuffer.clear() and writeBytes() recopy all previously received ClientHello body bytes for every additional TLS record. This causes quadratic CPU usage when an attacker sends a large ClientHello split into many tiny records, degrading TLS handling for other clients.

Detection Guidance

Detection involves monitoring for unusual CPU usage patterns during TLS handshakes or large ClientHello messages fragmented into many small records. Inspect network traffic for fragmented TLS records with excessive handshake data. Use tools like Wireshark to analyze TLS ClientHello sizes and fragmentation.

Impact Analysis

An unauthenticated remote attacker could exploit this to degrade server performance by consuming excessive CPU resources, potentially leading to denial-of-service conditions for legitimate clients trying to establish TLS connections.

Compliance Impact

This vulnerability causes excessive CPU usage due to quadratic work during TLS handshake processing, which could lead to denial-of-service conditions. Such resource exhaustion may impact availability of systems handling sensitive data, potentially violating compliance requirements for GDPR (availability of personal data) and HIPAA (access to protected health information).

Mitigation Strategies

Upgrade Netty to version 4.1.137.Final or later for 4.1.x, or 4.2.17.Final or later for 4.2.x. If upgrading is not immediately possible, consider disabling vulnerable SniHandler configurations or applying network-level mitigations to limit fragmented TLS record sizes.

Hi! I’m here to help you understand CVE-2026-75596. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70