Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Published September 8, 2026 CVE-2026-75595

Some Netty services can accept an attacker without the required client certificate. This happens only when the service relies on a specific certificate-routing setup.

Severity
CriticalCVSS 4.0 · 9.1
Fix
Fixed in 4.1.137.FinalFix recorded 2 days ago
Affected versions
before 4.1.137.Final; 4.2.0.Final or newer, but before 4.2.17.Final
Weakness
CWE-754Improper Check for Exceptional Conditions
Exploit likelihood
0.32% in 30 daysEPSS, higher than 24% of known flaws
Affects
Netty

How it works

  • The attacker starts an encrypted connection with its opening greeting split unusually.
  • Netty reads too early and hits an internal error.
  • It then uses the service's default security settings instead.
  • If those settings allow certificate-free access, the protected route becomes reachable.

What to do

Check the application's resolved Maven dependencies for io.netty:netty-handler. versions older than 4.1.137. Final and 4.2.0. Final through 4.2.16. Final are affected. Then confirm whether host-specific client certificates provide the service's only access check. An affected version shows possible exposure, not evidence of compromise.

Upgrade the 4.1 branch to 4.1.137. Final or later. Upgrade the 4.2 branch to 4.2.17. Final or later. Have the application maintainer confirm the deployed dependency and certificate checks against the Netty advisory.

Technical details

SslClientHelloHandler checks the wrong position before reading a four-byte TLS handshake header. A header divided across records triggers an IndexOutOfBoundsException, after which Netty selects the default SslContext. This bypasses SNI-based routing and can bypass mutual TLS only under the three configuration conditions documented by Netty.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions Present Attack depends on particular deployment or execution conditions
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption None No availability impact
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source