CVE-2026-116542GHSA-2784-hxmm-4hgf
Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
netty netty-tcnativeFrameworks
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
Text from CVE List
Affected versions 2
- netty-tcnativeaffected: all versions before 2.0.84.FinalCVE List
- netty-tcnative-boringssl-staticaffected: all versions before 2.0.84.FinalCVE List
References 6
- github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38Fixvia CVE List
- github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.FinalFixvia CVE List
- github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgfAdvisoryvia CVE List
- vulncheck.com/advisories/netty-netty-tcnative-before-2.0.84-final-sni-hostname-spoofing-via-modified-utf-8-decodingAdvisoryvia CVE List
- github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L2608Referencevia CVE List
- github.com/netty/netty-tcnativeReferencevia CVE List