Most recent entries from all

certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2026-avi-1165

CLEANSTART-2026-EO12643 — Security fix for CVE-2026-75596 applied in: elasticsearch 9.3.8-r5, solr 9.10.1-r8, solr 9.8.1-r3

Affected: CleanStart: elasticsearch, CleanStart: solr

CVE-2026-75596 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-357108

fkie_cve-2026-75596

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

GHSA-fccg-mwvh-qqg4 — Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing

Affected: Maven: io.netty:netty-handler

### Summary

Netty's default SNI entrypoint reparses and recopies previously received ClientHello fragments on every additional TLS handshake record. A remote peer can send a small first record that advertises a large ClientHello length and then drip the body in many tiny records, causing **superlinear (quadratic) CPU work** before the handshake completes. With 4095 one-byte fragments, the handler recopies **8,386,560 bytes** from only **24,579 bytes** on the wire — a **341× amplification** ratio.

### Affected Entrypoints

- `io.netty.handler.ssl.SniHandler` — default constructors - `io.netty.handler.ssl.SslClientHelloHandler` — pre-handshake ClientHello aggregation path

### Vulnerable Code Locations

- `handler/src/main/java/io/netty/handler/ssl/SniHandler.java:85` - `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:75` (decode entry) - `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:165` (handshakeBuffer.clear) - `handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:174` (writeBytes re-copy) - `codec-base/src/main/java/io/netty/handler/codec/ByteToMessageDecoder.java:294` (cumulation retention)

### Exploit Path

``` 1. TCP connection → SniHandler → SslClientHelloHandler.decode 2. First record: TLS handshake header declaring large ClientHello length (e.g., 4096 bytes) 3. Attacker sends thousands of tiny follow-on handshake records (1 byte each) 4. On each fragment: handshakeBuffer.clear() + writeBytes() re-copi…

openSUSE-SU-2026:11882-1 — netty-4.1.138-1.1 on GA media

netty-4.1.138-1.1 on GA media

UBUNTU-CVE-2026-75596

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:Pro:26.04:LTS: netty

WID-SEC-W-2026-2712 — Netty: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.