CVE-2026-75596 Overview
CVE-2026-75596 affects Netty, an asynchronous, event-driven network application framework widely used in Java-based servers, proxies, and middleware. The vulnerability resides in the default io.netty.handler.ssl.SniHandler constructors, which route pre-handshake ClientHello aggregation through SslClientHelloHandler#decode. An unauthenticated remote peer can advertise a large ClientHello and split its body across thousands of tiny TLS records, triggering quadratic CPU work on the event loop. The condition degrades TLS handling for all connected clients on the affected server. Netty released fixes in versions 4.1.137.Final and 4.2.17.Final.
Critical Impact
Remote unauthenticated attackers can exhaust event-loop CPU and disrupt TLS termination for concurrent clients without completing a handshake.
Affected Products
- Netty versions prior to 4.1.137.Final
- Netty versions prior to 4.2.17.Final
- Applications using the default io.netty.handler.ssl.SniHandler constructors
Discovery Timeline
- 2026-08-19 - CVE-2026-75596 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-75596
Vulnerability Analysis
The defect is an algorithmic complexity flaw [CWE-407] in Netty's pre-handshake ClientHello aggregation path. When the SniHandler receives a ClientHello fragmented across multiple TLS records, SslClientHelloHandler#decode calls handshakeBuffer.clear() and then writeBytes() to re-copy all previously received body bytes for every additional record. The aggregation cost grows as O(n²) with respect to the number of fragments. A single attacker connection can therefore consume disproportionate event-loop time before any TLS session is negotiated.
Because Netty processes I/O on a small pool of event-loop threads, a stalled loop delays handshake processing for every other client bound to that loop. Multiple parallel attacker connections amplify the impact into a full TLS denial-of-service condition.
Root Cause
The root cause is a re-copy-on-append pattern inside handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java. Rather than appending new fragment bytes to the accumulation buffer, the decoder clears the buffer and rewrites the full aggregated payload on every record. This turns per-record work into work proportional to the total bytes already received.
Attack Vector
Exploitation requires only network reach to a TLS listener that installs the default SniHandler. The attacker advertises a large ClientHello length and delivers the body in thousands of small TLS records, driving quadratic aggregation cost per connection. No authentication, user interaction, or completed handshake is required.
The vulnerability was patched in Netty pull requests #17213 and #17217. The fixes are merged in commits 1b5abc6 and 9e05192. Refer to the GitHub Security Advisory GHSA-fccg-mwvh-qqg4 for advisory metadata and affected version ranges.
Detection Methods for CVE-2026-75596
Indicators of Compromise
- Sustained high CPU utilization on Netty event-loop threads without a matching increase in completed TLS handshakes.
- Long-lived inbound connections that transmit many small TLS record fragments before any ChangeCipherSpec message.
- Elevated ratio of ClientHello bytes received to handshakes completed per source IP.
- TLS handshake latency spikes affecting unrelated clients sharing the same event loop.
Detection Strategies
- Monitor per-thread CPU on Java processes hosting Netty and correlate with TLS record throughput.
- Instrument the SniHandler pipeline with metrics on ClientHello fragment counts per connection and alert on outliers.
- Inspect network traffic for TCP streams delivering unusually small TLS record sizes toward TLS listeners.
Monitoring Recommendations
- Track the Netty version in inventory scans and dependency SBOMs against the fixed releases 4.1.137.Final and 4.2.17.Final.
- Alert on connections that transmit hundreds or thousands of TLS records without completing a handshake within a short window.
- Capture event-loop stall metrics and correlate against source IP reputation and geolocation.
How to Mitigate CVE-2026-75596
Immediate Actions Required
- Upgrade Netty to 4.1.137.Final or 4.2.17.Final in all direct and transitive dependencies.
- Audit application dependency trees using mvn dependency:tree or gradle dependencies to locate vulnerable Netty versions bundled by frameworks such as Spring, gRPC, or Elasticsearch clients.
- Rate-limit inbound TLS connections and restrict source IPs that produce anomalous ClientHello fragmentation patterns.
Patch Information
Netty resolved the flaw in Netty 4.1.137.Final and Netty 4.2.17.Final. The remediation replaces the clear-and-rewrite aggregation with an append-only strategy in SslClientHelloHandler, restoring linear-time behavior. Merge commits 1b5abc6 and 9e05192 carry the fix into the 4.1 and 4.2 branches respectively.
Workarounds
- Terminate TLS at a front-end proxy or load balancer that is not affected by this issue while patching downstream Netty services.
- Reduce exposure by enforcing minimum TLS record sizes or maximum ClientHello sizes at an upstream network device where feasible.
- Constrain the number of concurrent unauthenticated TLS connections per source with connection-limit rules.
# Maven: pin fixed Netty version across a project via dependencyManagement
mvn versions:set-property -Dproperty=netty.version -DnewVersion=4.1.137.Final
mvn dependency:tree | grep -i netty
# Gradle: verify resolved Netty version
./gradlew dependencies --configuration runtimeClasspath | grep netty
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
