CVE-2026-75595 – mTLS/SNI Authentication Bypass – Netty netty-handler 4.1.x < 4.1.137.Final and 4.2.

Summary

CVE-2026-75595 is a critical authentication-bypass vulnerability in the netty-handler module of the Netty framework, affecting how SslClientHelloHandler parses fragmented TLS ClientHello messages. In deployments that rely on Server Name Indication (SNI) to select a per-hostname SslContext enforcing mutual TLS (clientAuth=REQUIRE), a malformed or fragmented handshake can force Netty to silently fall back to a less-restrictive default SslContext, allowing an unauthenticated remote attacker to bypass the intended client-certificate requirement. The issue carries a CVSS score of 9.1 (Critical).

Technical details

• Root cause: SslClientHelloHandler#decode checks the wrong buffer offset when looking for the TLS handshake header, effectively ignoring the 5-byte TLS record header.
• Trigger condition: When a ClientHello is split across multiple TLS records and the first record’s payload is smaller than 4 bytes, the offset miscalculation causes an IndexOutOfBoundsException.
• Impact of the exception: The generic exception handler catches this error and invokes select(ctx, null), causing Netty to select the default SslContext instead of the SNI-specific one that was intended to be selected based on the requested hostname.
• Attack vector: Network-based, no authentication or user interaction required; an attacker only needs to send a specially fragmented TLS ClientHello to a Netty-based TLS/mTLS endpoint.
• Impact: In deployments where per-SNI SslContext is the sole mechanism enforcing mutual TLS (clientAuth=REQUIRE) for a given hostname, and the default SslContext allows connections with clientAuth=NONE/OPTIONAL, an attacker can bypass client-certificate authentication entirely and reach routes/services that were assumed to be protected by mTLS. There is no additional peer-certificate verification at the application layer in vulnerable configurations, so this can lead to unauthorized access to sensitive backend services.

Affected software

• io.netty:netty-handler versions 4.1.136.Final and earlier (4.1.x line)
• io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final (4.2.x line)

Severity

• CVSS v4.0 Base Score: 9.1 (Critical)
• Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
• CWE-754: Improper Check for Unusual or Exceptional Conditions

Mitigation and recommended actions

• Immediate: Upgrade Netty to the patched releases:
  • 4.1.137.Final or later (for the 4.1.x line)
  • 4.2.17.Final or later (for the 4.2.x line)
• If immediate patching is not possible:
  • Configure the default SslContext to enforce the same (or stricter) clientAuth requirements as any per-SNI SslContext, so that a fallback does not weaken authentication requirements.
  • Add independent, application-layer verification of the client certificate (do not rely solely on the SNI-selected SslContext to enforce mTLS).
  • Audit any deployment where mTLS enforcement differs by SNI/hostname behind a shared Netty-based listener, and treat these as high priority for patching or compensating controls until upgraded.

References

• CVE-2026-75595 at NVD
• Netty GitHub Security Advisory GHSA-c4c3-7fpv-j4q5
• CVE Record (CVEProject/cvelistV5)