CVE-2026-45416 Overview
CVE-2026-45416 is a high-severity denial-of-service vulnerability in Netty, an asynchronous event-driven network application framework widely used to build protocol servers and clients in Java. The flaw resides in SslClientHelloHandler.decode(), where the handler eagerly allocates a buffer sized from the attacker-controlled 24-bit TLS handshake length. When applications use the default SniHandler or AbstractSniHandler constructors, the length guard and handshake timeout are disabled, allowing remote unauthenticated clients to force large unpooled allocations. The issue is fixed in Netty 4.1.135.Final and 4.2.15.Final.
Critical Impact
A single malformed TLS ClientHello can trigger a 16 MiB heap allocation that persists until the channel closes, enabling remote denial-of-service through memory exhaustion against any Netty-based TLS endpoint using default SNI handler configuration.
Affected Products
- Netty netty versions prior to 4.1.135.Final
- Netty netty versions prior to 4.2.15.Final
- Applications using SniHandler(Mapping), SniHandler(AsyncMapping), or AbstractSniHandler() default constructors
Discovery Timeline
- 2026-06-12 - CVE-2026-45416 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-45416
Vulnerability Analysis
The vulnerability is classified as Allocation of Resources Without Limits or Throttling [CWE-770]. SslClientHelloHandler.decode() reads the 24-bit TLS handshake length field directly from the incoming record. When the ClientHello does not fit within the first TLS record, the handler calls ctx.alloc().buffer(handshakeLength) at line 161 to accumulate the remaining bytes.
The guard at line 140 evaluates handshakeLength > maxClientHelloLength && maxClientHelloLength != 0. When maxClientHelloLength is 0, the check short-circuits and the length is never validated. Because handshakeTimeoutMillis is also 0 under the default constructors, no watchdog cancels stalled handshakes. A 16 MiB request exceeds Netty's default pooled chunk size and falls into the huge-allocation path as an unpooled buffer.
Root Cause
The SniHandler(Mapping), SniHandler(AsyncMapping), and AbstractSniHandler() constructors pass maxClientHelloLength=0 and handshakeTimeoutMillis=0 to the parent class. These zero values disable both the length cap and the timeout, leaving the eager allocation unrestricted by any application-layer control.
Attack Vector
An unauthenticated remote attacker opens a TLS connection and sends a TLS record containing a ClientHello header that advertises a 24-bit handshake length up to 16,777,215 bytes. The attacker does not need to complete the handshake or send the remaining bytes. The handler allocates the full buffer immediately and retains it until channel closure. Repeated connections multiply the allocated memory and exhaust the JVM heap.
No exploitation code is required beyond a crafted TLS handshake; standard TLS testing utilities can be configured to emit oversized ClientHello length fields. See the GitHub Security Advisory GHSA-x4gw-5cx5-pgmh for the vendor analysis.
Detection Methods for CVE-2026-45416
Indicators of Compromise
- Sudden growth in JVM heap usage on Netty-based services, particularly in unpooled direct or heap buffer allocators.
- TLS connections that advertise a large handshake length but never complete the ClientHello payload.
- OutOfMemoryError exceptions originating from io.netty.handler.ssl.SslClientHelloHandler or AbstractSniHandler in application logs.
Detection Strategies
- Inventory Java applications and identify Netty versions through dependency scanning of pom.xml, build.gradle, or SBOM data.
- Inspect TLS-terminating services for use of SniHandler constructors that omit maxClientHelloLength and handshakeTimeoutMillis parameters.
- Monitor TLS traffic for ClientHello records whose declared handshake length exceeds expected client sizes (typically under 4 KiB).
Monitoring Recommendations
- Emit JVM heap and garbage collection metrics to a centralized telemetry pipeline and alert on sustained growth on TLS frontends.
- Track per-connection allocation sizes via Netty's ResourceLeakDetector and ByteBufAllocatorMetric instrumentation.
- Correlate network telemetry with process memory metrics to identify hosts under TLS-borne resource exhaustion.
How to Mitigate CVE-2026-45416
Immediate Actions Required
- Upgrade Netty to 4.1.135.Final for the 4.1 branch or 4.2.15.Final for the 4.2 branch.
- Rebuild and redeploy all downstream applications and frameworks that bundle vulnerable Netty versions, including Spring, gRPC, Vert.x, and Reactor Netty deployments.
- Restrict exposure of TLS endpoints to trusted networks until patching is complete.
Patch Information
The maintainers fixed the issue in the Netty 4.1.135.Final release and Netty 4.2.15.Final release. The patch enforces a bounded allocation in SslClientHelloHandler.decode() and applies sane defaults for maxClientHelloLength and handshakeTimeoutMillis in the affected constructors.
Workarounds
- Replace default SniHandler constructors with overloads that pass an explicit maxClientHelloLength (for example, 16384 bytes) and a non-zero handshakeTimeoutMillis.
- Place a TLS-terminating reverse proxy in front of Netty services to validate ClientHello sizes before traffic reaches the application.
- Apply per-connection rate limiting and idle connection timeouts at the network or load balancer layer to bound allocation pressure.
# Maven dependency upgrade example
mvn versions:use-dep-version -Dincludes=io.netty:netty-all -DdepVersion=4.1.135.Final -DforceVersion=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
