CVE-2026-75596 – Denial of Service (Pre-Handshake CPU Exhaustion) – Netty netty-handler 4.1.x < 4.1.

Summary

CVE-2026-75596 is a denial-of-service vulnerability (CWE-407: Inefficient Algorithmic Complexity) in the Netty networking framework’s TLS Server Name Indication (SNI) handling logic. The SniHandler and SslClientHelloHandler components perform quadratic-time buffer reassembly when processing a fragmented TLS ClientHello message, allowing an unauthenticated remote attacker to exhaust event-loop CPU resources with a small amount of traffic. The issue carries a CVSS score of 8.7 (High) and requires no authentication or user interaction to exploit.

Technical details

• Root cause: When reassembling a fragmented ClientHello, Netty’s pre-handshake buffer logic calls handshakeBuffer.clear() followed by writeBytes() on every incoming fragment, recopying all previously buffered bytes each time rather than appending incrementally. This produces total-copy behavior of O(n²) — specifically n*(n+1)/2 bytes copied for n bytes of ClientHello body received.
• Trigger conditions: An attacker advertises a ClientHello with a large declared size in the initial TLS record, then delivers the ClientHello body split across thousands of very small (e.g., single-byte) TCP/TLS record fragments before the handshake completes.
• Attack vector: Network-based, unauthenticated, requires no prior access or user interaction — only the ability to open a TCP connection to a TLS listener that uses Netty’s default SNI/ClientHello handling.
• Impact: Reported amplification of roughly 341x (approximately 24.5 KB of attacker-sent data results in over 8 MB of internal copy operations), causing event-loop CPU exhaustion and degraded or unavailable TLS connection handling for legitimate clients — a pre-handshake denial-of-service condition. Confidentiality and integrity are not affected; impact is limited to availability.

Affected software

• io.netty:netty-handler (and dependent Netty distributions) versions:
  • All 4.1.x releases prior to 4.1.137.Final
  • All 4.2.x releases from 4.2.0.Final through 4.2.16.Final
• Vulnerable components: SniHandler (when using its default constructors) and SslClientHelloHandler

Severity

• CVSS Score: 8.7 (High)
• Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  (Network attack vector, low attack complexity, no privileges or user interaction required, high impact to availability only)

Mitigation and recommended actions

• Immediate: Upgrade Netty to the patched releases:
  • 4.1.137.Final or later (for the 4.1.x line)
  • 4.2.17.Final or later (for the 4.2.x line)
• If immediate patching is not possible:
  • Place TLS-terminating Netty services behind a reverse proxy, load balancer, or CDN that performs its own TLS handshake and can rate-limit or reject connections that transmit abnormally fragmented or slow-trickled ClientHello data.
  • Apply connection-level protections such as idle/handshake timeouts and per-connection byte-rate limits at the network layer to reduce the effectiveness of slow, fragmented handshake attacks.
  • Monitor for anomalous patterns of TLS connections with unusually high fragment counts or prolonged pre-handshake phases, which may indicate exploitation attempts.
  • After upgrading, no configuration changes are required — the fix addresses the underlying buffer reassembly algorithm.

References

• CVE-2026-75596 at NIST NVD
• Netty Security Advisory GHSA-fccg-mwvh-qqg4
• CVE-2026-75596 CVE Record (cvelistV5)