CVE-2026-45416: Netty Handler Vulnerability Leading to Excessive Memory Allocation
Summary
CVE-2026-45416: Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes. Affects io.netty:netty-handler across 2 version ranges.
< 4.1.135.Final
>= 4.2.0.Final, < 4.2.15.Final
Fixed in 4.1.135.Final or 4.2.15.Final, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a widely-used asynchronous event-driven network application framework that enables quick and efficient development of network applications such as protocol servers and clients. It is known for its high performance and low latency, making it a popular choice for building scalable network applications. However, certain versions of the Netty handler package are vulnerable to a memory allocation issue that can be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the SslClientHelloHandler.decode() method, which reads the 24-bit TLS handshake length. If the ClientHello message does not fit in the first record, it pre-allocates a buffer based on the handshake length without proper validation. The guard condition that checks if the handshake length exceeds a maximum limit is disabled in commonly used constructors, allowing an attacker to send a specially crafted ClientHello message that can lead to excessive memory allocation of up to 16 MiB. This can result in denial of service due to resource exhaustion, as the buffer remains allocated until the channel closes.
How To Fix
Latest published version: 5.0.0.Alpha2 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.1.135.Final4.1.135.Final -
>= 4.2.0.Final, < 4.2.15.Final4.2.15.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement a custom SniHandler that includes a maximum client hello length check to prevent excessive memory allocation. This can be done by overriding the decode method to include validation logic before allocating buffers.
Conclusion
The CVE-2026-45416 vulnerability in the Netty handler package poses a significant risk due to excessive memory allocation that can be exploited by attackers. It is crucial to update to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your applications effectively.
See every vulnerability recorded for io.netty:netty-handler →
FAQ
CVE-2026-45416 is a vulnerability in the Netty handler package that allows attackers to exploit memory allocation issues, potentially leading to denial of service.
Affected versions include Netty handler versions up to 4.2.14.Final and 4.1.134.Final.
You can use Vulert, which monitors and alerts for open-source vulnerabilities using just your pom.xml file. Visit Vulert Scanner to check your application without signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing a custom SniHandler to validate handshake lengths and prevent excessive memory allocation as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-handler.
