cve-2026-75596

{
  "cvss": 8.7,
  "datePublished": "2026-08-19T21:17:37.740",
  "dateUpdated": "2026-10-26T10:10:00.140",
  "description": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.",
  "id": "CVE-2026-75596",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "product": "netty",
            "vendor": "netty",
            "versions": [
              {
                "status": "affected",
                "version": "< 4.1.137.Final"
              },
              {
                "status": "affected",
                "version": ">= 4.2.0.Final, < 4.2.17.Final"
              }
            ]
          }
        ],
        "source": "security-advisories@github.com"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "C2D95C1D-B022-435F-B4C7-33FC460064EA",
                "versionEndExcluding": "4.1.137",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "80E3B839-CD5C-45D0-81C0-CABCE7A5D9AF",
                "versionEndExcluding": "4.2.17",
                "versionStartIncluding": "4.2.0",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final."
      },
      {
        "lang": "es",
        "value": "Netty es un framework de aplicación de red asíncrono y basado en eventos. Antes de las versiones 4.1.137.Final y 4.2.17.Final, los constructores predeterminados de io.netty.handler.ssl.SniHandler utilizan la ruta de agregación de ClientHello previa al handshake en handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java en io.netty.handler.ssl.SslClientHelloHandler#decode, donde handshakeBuffer.clear() y writeBytes() vuelven a copiar todos los bytes del cuerpo recibidos previamente por cada registro TLS adicional. Un par remoto no autenticado puede anunciar un ClientHello grande y entregar su cuerpo en miles de registros pequeños, causando un trabajo de CPU cuadrático en el bucle de eventos antes de que se complete el handshake TLS y degradando el manejo de TLS para otros clientes. Este problema se corrige en las versiones 4.1.137.Final y 4.2.17.Final."
      }
    ],
    "id": "CVE-2026-75596",
    "lastModified": "2026-10-26T10:10:00.140",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6,
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ],
      "cvssMetricV40": [
        {
          "cvssData": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "availabilityRequirement": "NOT_DEFINED",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityRequirement": "NOT_DEFINED",
            "exploitMaturity": "NOT_DEFINED",
            "integrityRequirement": "NOT_DEFINED",
            "modifiedAttackComplexity": "NOT_DEFINED",
            "modifiedAttackRequirements": "NOT_DEFINED",
            "modifiedAttackVector": "NOT_DEFINED",
            "modifiedPrivilegesRequired": "NOT_DEFINED",
            "modifiedSubAvailabilityImpact": "NOT_DEFINED",
            "modifiedSubConfidentialityImpact": "NOT_DEFINED",
            "modifiedSubIntegrityImpact": "NOT_DEFINED",
            "modifiedUserInteraction": "NOT_DEFINED",
            "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
            "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
            "modifiedVulnIntegrityImpact": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "source": "security-advisories@github.com",
          "type": "Secondary"
        }
      ],
      "ssvcV203": [
        {
          "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "ssvcData": {
            "id": "CVE-2026-75596",
            "options": [
              {
                "exploitation": "none"
              },
              {
                "automatable": "yes"
              },
              {
                "technicalImpact": "partial"
              }
            ],
            "role": "CISA Coordinator",
            "timestamp": "2026-08-20T19:59:07.317390Z",
            "version": "2.0.3"
          }
        }
      ]
    },
    "published": "2026-08-19T21:17:37.740",
    "references": [
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Patch"
        ],
        "url": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Issue Tracking",
          "Patch"
        ],
        "url": "https://github.com/netty/netty/pull/17213"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Issue Tracking",
          "Patch"
        ],
        "url": "https://github.com/netty/netty/pull/17217"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Release Notes"
        ],
        "url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
      },
      {
        "source": "security-advisories@github.com",
        "tags": [
          "Vendor Advisory"
        ],
        "url": "https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4"
      }
    ],
    "sourceIdentifier": "security-advisories@github.com",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-407"
          }
        ],
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "severity": "HIGH",
  "source": "nvd",
  "title": "Netty is an asynchronous, event-driven network application framework"
}