Log in Start free

Vulnerability · Published Jun 12, 2026 · Assigned by GitHub_M

CVE-2026-45416Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

High 7.5

In plain English

A high-severity resource allocation without limits in netty from netty. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.9%top 39.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nettyno fix listedDEBIAN-CVE-2026-45416
Debian:13nettyno fix listedDEBIAN-CVE-2026-45416
Debian:14nettyno fix listedDEBIAN-CVE-2026-45416
Mavenio.netty:netty-handler4.1.135.FinalGHSA-x4gw-5cx5-pgmh
Mavenio.netty:netty-handler4.2.15.FinalGHSA-x4gw-5cx5-pgmh
Ubuntu:25.10nettyno fix listedUBUNTU-CVE-2026-45416
Ubuntu:26.10nettyno fix listedUBUNTU-CVE-2026-45416

Affected products (as reported)

VendorProductVersions
netty netty >= 4.2.0.Final, < 4.2.15.Final< 4.1.135.Final

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References