CVE-2026-75595: Netty SNI Routing Bypass via Fragmented TLS ClientHello
Summary
CVE-2026-75595: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext. Affects io.netty:netty-handler across 2 version ranges.
< 4.1.137.Final
>= 4.2.0.Final, < 4.2.17.Final
Fixed in 4.1.137.Final or 4.2.17.Final, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Netty is a popular open-source Java framework that provides asynchronous event-driven network application development. It is widely used for building high-performance network applications such as web servers, clients, and proxies. The framework's SSL/TLS capabilities allow for secure communication, but vulnerabilities in its implementation can lead to serious security risks, particularly in environments where mutual TLS (mTLS) is enforced.
Vulnerability Detail
The vulnerability arises from a flaw in the SslClientHelloHandler's decoding process, where a fragmented TLS ClientHello can cause Netty to fall back to a default SslContext. This fallback occurs when the handshake header is incorrectly processed, allowing an unauthenticated attacker to bypass mTLS requirements. The issue is exacerbated when mTLS is enforced solely through per-SNI SslContext, and the default SslContext is configured to be permissive. This could lead to unauthorized access and data breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.1.137.Final4.1.137.Final -
>= 4.2.0.Final, < 4.2.17.Final4.2.17.Final
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement additional application-layer checks for client certificates to mitigate the risk of unauthorized access while waiting for the patch to be applied.
Conclusion
CVE-2026-75595 presents a significant security risk for applications using the Netty framework, particularly those relying on mTLS for secure communications. It is crucial to update to the latest patched versions to mitigate this vulnerability and ensure the integrity of your application's security.
See every vulnerability recorded for io.netty:netty-handler →
FAQ
CVE-2026-75595 is a vulnerability in the Netty framework that allows attackers to bypass mutual TLS (mTLS) requirements through a fragmented TLS ClientHello.
If your application uses Netty with mTLS enforced solely through per-SNI SslContext, this vulnerability could allow unauthorized access to sensitive data.
Affected versions include Netty 4.2.0.Final to 4.2.16.Final and 4.1.0.Final to 4.1.136.Final.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 9.1, indicating a critical level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for io.netty:netty-handler.
