Skip to content
OpenAdvisories

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

Affected products

VendorProductAffectedFixed
netty netty < 4.1.137.Final, >= 4.2.0.Final, < 4.2.17.Final —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 netty No fix yet —
Debian 13 netty No fix yet —
Debian 12 netty No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 netty No fix yet —
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS netty No fix yet —
Ubuntu Pro 24.04 LTS netty No fix yet —
Ubuntu Pro 22.04 LTS netty No fix yet —
Ubuntu Pro 20.04 LTS netty No fix yet —
Ubuntu Pro 18.04 LTS netty No fix yet —
Ubuntu Pro 16.04 LTS netty No fix yet —
Ubuntu Pro 14.04 LTS netty No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 netty 4.1.138-150200.4.56.1 SUSE-SU-2026:4391-1
SLES 15 SP7 netty-tcnative 2.0.84-150200.3.51.1 SUSE-SU-2026:4391-1
SLES 15 SP6 netty-tcnative 2.0.84-150200.3.51.1 SUSE-SU-2026:4391-1
SLES 15 SP5 netty-tcnative 2.0.84-150200.3.51.1 SUSE-SU-2026:4391-1
SLES 15 SP4 netty-tcnative 2.0.84-150200.3.51.1 SUSE-SU-2026:4391-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 netty-tcnative 2.0.84-150200.3.51.1 SUSE-SU-2026:4391-1
SLES for SAP 15 SP5 netty-tcnative 2.0.84-150200.3.51.1 SUSE-SU-2026:4391-1
SLES for SAP 15 SP4 netty-tcnative 2.0.84-150200.3.51.1 SUSE-SU-2026:4391-1
SLE HPC 15 SP5 netty-tcnative 2.0.84-150200.3.51.1 SUSE-SU-2026:4391-1
SLE HPC 15 SP4 netty-tcnative 2.0.84-150200.3.51.1 SUSE-SU-2026:4391-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed netty 4.1.138-1.1 openSUSE-SU-2026:11882-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.28.0-r8 —
Wolfi rolling cassandra-5.0 5.0.9-r7 —
Wolfi rolling cassandra-reaper 5.0.1-r1 —
Wolfi rolling celeborn-0.6 0.6.3-r21 —
Wolfi rolling druid 37.0.0-r56 —
Wolfi rolling flyway 13.6.0-r2 —
Wolfi rolling keycloak-26.5 +2 26.5.7-r7 —
Wolfi rolling keycloak-26.6 +2 26.6.6-r1 —
Wolfi rolling logstash-9.3 +1 No fix yet —
Wolfi rolling sonarqube 26.8.0.126808-r3 —
Wolfi rolling spark-4.0-scala-2.13 4.0.4-r4 —
Wolfi rolling strimzi-kafka-operator-kafka-thirdparty-libs-cc 1.2.0-r4 —
Wolfi rolling tez 0.10.5-r30 —
Wolfi rolling trino-plugin-opensearch 483-r7 —
Wolfi rolling zookeeper-3.9 3.9.5-r14 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.netty:netty-handler >= 4.2.0.Final, < 4.2.17.Final 4.2.17.Final GHSA-fccg-mwvh-qqg4
Maven io.netty:netty-handler < 4.1.137.Final 4.1.137.Final GHSA-fccg-mwvh-qqg4

Advisories 6

References