CVE-2026-116541GHSA-9xr3-jwv4-r489
netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount
netty netty-tcnativeFrameworks
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.
Text from CVE List
Affected versions 2
- netty-tcnativeaffected: all versions before 2.0.84.FinalCVE List
- netty-tcnative-boringssl-staticaffected: all versions before 2.0.84.FinalCVE List
References 6
- github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745bFixvia CVE List
- github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.FinalFixvia CVE List
- github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489Advisoryvia CVE List
- vulncheck.com/advisories/netty-tcnative-before-2.0.84-final-denial-of-service-via-bio-write-overcountAdvisoryvia CVE List
- github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ssl.c#L240Referencevia CVE List
- github.com/netty/netty-tcnativeReferencevia CVE List