p PatchFirst

CVE-2026-116542

CVE-2026-116542 · Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

CVSS 6.9 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • netty-tcnative

    Versions
    • ≥ 0, < 2.0.84.Final: Affected (custom)

    Update to 2.0.84.Final

  • netty-tcnative-boringssl-static

    Versions
    • ≥ 0, < 2.0.84.Final: Affected (custom)

    Update to 2.0.84.Final

  • netty-tcnative Debian:12

    Versions
    • 2.0.28-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-tcnative Debian:13

    Versions
    • 2.0.28-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-tcnative Debian:14

    Versions
    • 2.0.28-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-tcnative Ubuntu:16.04:LTS

    Versions
    • 1.1.33.Fork6-1
    • 1.1.33.Fork10-2
    • 1.1.33.Fork14-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-tcnative Ubuntu:18.04:LTS

    Versions
    • 1.1.33.Fork26-1
    • 1.1.33.Fork26-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-tcnative Ubuntu:20.04:LTS

    Versions
    • 2.0.20-1
    • 2.0.28-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-tcnative Ubuntu:22.04:LTS

    Versions
    • 2.0.28-1
    • 2.0.28-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-tcnative Ubuntu:24.04:LTS

    Versions
    • 2.0.28-1build1
    • 2.0.28-1build2
    • 2.0.28-1build3
    • 2.0.28-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-tcnative Ubuntu:26.10

    Versions
    • 2.0.28-1build5
    • 2.0.28-1build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty-tcnative Ubuntu:26.04:LTS

    Versions
    • 2.0.28-1build4
    • 2.0.28-1build5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →