Skip to content
Fencer Vulns
critical 9.1

CVE-2026-75595 json

Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

published 2026-08-19 2 mo ago modified 2026-10-26 13 d ago also GHSA-c4c3-7fpv-j4q5 , EUVD-2026-63095

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits
0
none known

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Patch / fix

  • maven io.netty:netty-handler 4.1.137.Final, 4.2.17.Final
  • netty netty 4.1.137, 4.2.17
  • netty-tcnative SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.0.84-150200.3.51.1
  • netty SLE Module for Package Hub 15 SP7 4.1.138-150200.4.56.1

suse advisories SUSE-SU-2026:4391-1

  • netty openSUSE Tumbleweed 4.1.138-1.1

opensuse advisories openSUSE-SU-2026:11882-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-75595 updated cvss 7.4

io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

  • Red Hat AMQ Clients netty-handler Red Hat build of Apicurio Registry 3 netty-handler Red Hat Ceph Storage 9 libarrow, parquet-libs Red Hat Data Grid 8 netty-handler
    affected: workaround, no fix available
  • Red Hat Fuse 7 netty-handler
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform 7 netty-handler
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/server-rhel9, devspaces/openvsx-rhel9, devspaces/jetbrains-ide-rhel9, devspaces/pluginregistry-rhel9, devspaces/multicluster-redirector-rhel9
    affected: workaround, no fix available
  • Red Hat Single Sign-On 7 netty-handler
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, +4 more Red Hat Enterprise Linux AI (RHEL AI) 3 bazel6, bazel7, bazel8 Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9, redhat-user-workloads/rhocc-mimir-tenant/mimir/rhokp-core-encrypted Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-trustyai-service-rhel9, rhoai/odh-th-torch-cpu-py312-rhel9, rhoai/odh-th-torch-cuda-py312-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, +4 more Red Hat OpenStack Platform 13 (Queens) opendaylight
    +1 more products
    Red Hat Satellite 6 candlepin, candlepin-selinux
    under investigation
  • Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
    fixed: vendor fix RHSA-2026:71675
  • Red Hat Build of Debezium 3.6
    fixed: vendor fix RHSA-2026:83612
show 7 more
  • Red Hat build of Keycloak 26.4 rhbk/keycloak-rhel9 26.4-29, rhbk/keycloak-rhel9-operator 26.4-30, rhbk/keycloak-operator-bundle 26.4.17-2
    fixed: vendor fix RHSA-2026:95760
  • Red Hat build of Keycloak 26.4.17
    fixed: vendor fix RHSA-2026:95759
  • Red Hat build of Keycloak 26.6 rhbk/keycloak-rhel9 26.6-24, rhbk/keycloak-rhel9-operator 26.6-24, rhbk/keycloak-operator-bundle 26.6.8-2
    fixed: vendor fix RHSA-2026:95762
  • Red Hat build of Keycloak 26.6.8
    fixed: vendor fix RHSA-2026:95761
  • Red Hat JBoss Enterprise Application Platform 8.1
    fixed: vendor fix RHSA-2026:95887
  • Red Hat AMQ Broker 7 netty-handler Red Hat build of Apache Camel 4 for Quarkus 3 netty-handler Red Hat build of Quarkus netty-handler
    not affected: vulnerable code not present
  • Red Hat JBoss Enterprise Application Platform Expansion Pack netty-handler
    not affected: component not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA 4.0 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven io.netty:netty-handler
>=4.2.0.Final, <4.2.17.Final
<4.1.137.Final
4.2.17.Final
4.1.137.Final

Affected products

  • netty netty

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions
  • CWE-475 Undefined Behavior for Input to API

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.