critical
CVE-2026-75595
io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GHSA9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Red Hat7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Red Hat (high).
Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | io.netty:netty-handler | 4.2.17.Final, 4.1.137.Final |
| chainguard | akhq, apache-camel-karavan-devmode, apache-hop and 71 more | 0.28.0-r8 and 64 more |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| echo maven::Echo OSV | io.netty:netty-handler | 4.1.137.Final |
| minimos | apache-activemq-artemis, apache-druid, apache-druid-fips and 57 more | 2.56.0-r0 and 38 more |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| Red Hat | candlepin, candlepin-selinux, libarrow and 4 more | no fix listed |
Show all 182 entries from 14 sources
| Source | Package | Fixed in |
|---|---|---|
| maven::GitHub Security Advisory Maven | io.netty:netty-handler | 4.2.17.Final, 4.1.137.Final |
| chainguard | akhq | 0.28.0-r8 |
| chainguard | apache-camel-karavan-devmode | 4.18.1-r12 |
| chainguard | apache-hop | 2.19.0-r3 |
| chainguard | apache-nifi-2.11 | 2.11.0-r7 |
| chainguard | cassandra-5.0 | 5.0.9-r7 |
| chainguard | cassandra-fips-5.0 | 5.0.8-r14 |
| chainguard | cassandra-reaper | 5.0.1-r1 |
| chainguard | celeborn-0.7 | 0.7.0-r8 |
| chainguard | commercial-elasticsearch-8.19 | 8.19.22-r0 |
| chainguard | commercial-elasticsearch-9.4 | 9.4.8-r0 |
| chainguard | commercial-elasticsearch-9.5 | 9.5.5-r0 |
| chainguard | cruise-control | 2.5.146-r4 |
| chainguard | cruise-control-fips | 2.5.146-r5 |
| chainguard | drain-cleaner | 1.6.1-r3 |
| chainguard | drain-cleaner-fips | 1.6.1-r2 |
| chainguard | druid | 37.0.0-r56 |
| chainguard | elasticsearch-8.19 | 8.19.21-r1 |
| chainguard | elasticsearch-9.4 | 9.4.8-r0 |
| chainguard | elasticsearch-9.5 | 9.5.5-r0 |
| chainguard | elasticsearch-fips-8.19 | 8.19.21-r1 |
| chainguard | elasticsearch-fips-9.4 | 9.4.8-r0 |
| chainguard | elasticsearch-fips-9.5 | 9.5.5-r0 |
| chainguard | floci | 2.0.1-r1 |
| chainguard | floci-az | 0.12.0-r1 |
| chainguard | flyway | 13.6.0-r2 |
| chainguard | flyway-fips | 13.6.0-r1 |
| chainguard | ghidra | 12.1.3-r3 |
| chainguard | hadoop-fips-3.5 | 3.5.0-r14 |
| chainguard | hono | 2.7.0-r40 |
| chainguard | kafka-3.7 | 3.7.2-r59 |
| chainguard | kafka-3.8 | 3.8.1-r61 |
| chainguard | kafka-3.9 | 3.9.2-r15 |
| chainguard | kayenta-2025.2 | 2025.2.4-r10 |
| chainguard | kayenta-2025.4 | 2025.4.6-r15 |
| chainguard | kayenta-2026.1 | 2026.1.2-r6 |
| chainguard | kayenta-fips-2026.0 | 2026.0.5-r4 |
| chainguard | kayenta-fips-2026.1 | 2026.1.2-r6 |
| chainguard | keycloak-26.5 | 26.5.7-r7 |
| chainguard | keycloak-26.6 | 26.6.6-r1 |
| chainguard | keycloak-26.7 | 26.7.3-r1 |
| chainguard | keycloak-fips-26.5 | 26.5.7-r13 |
| chainguard | keycloak-fips-26.6 | 26.6.6-r1 |
| chainguard | keycloak-fips-26.7 | 26.7.3-r1 |
| chainguard | knative-kafka-broker-1.20 | 1.20.3-r17 |
| chainguard | knative-kafka-broker-1.22 | 1.22.3-r13 |
| chainguard | knative-kafka-broker-1.23 | 1.23.1-r3 |
| chainguard | knative-kafka-broker-fips-1.20 | 1.20.3-r15 |
| chainguard | knative-kafka-broker-fips-1.22 | 1.22.3-r9 |
| chainguard | knative-kafka-broker-fips-1.23 | 1.23.1-r4 |
| chainguard | logstash-8.19 | 8.19.21-r0 |
| chainguard | logstash-9.2 | 9.2.8-r6 |
| chainguard | management-api-for-apache-cassandra-4.0 | 0.1.125-r3 |
| chainguard | neo4j-2026.02 | 2026.02.3-r4 |
| chainguard | neo4j-2026.03 | 2026.03.1-r4 |
| chainguard | pinot | 1.5.1-r19 |
| chainguard | pinot-fips | 1.5.1-r15 |
| chainguard | request-9047-keycloak-fips-26.5 | 26.5.7-r27 |
| chainguard | request-9047-keycloak-fips-26.6 | 26.6.6-r2 |
| chainguard | request-9047-keycloak-fips-26.7 | 26.7.3-r1 |
| chainguard | seata | 2.7.0-r9 |
| chainguard | sonarqube | 26.8.0.126808-r3 |
| chainguard | spark-3.5 | 3.5.9-r5 |
| chainguard | spark-4.0 | 4.0.4-r4 |
| chainguard | spark-4.2 | 4.2.0-r10 |
| chainguard | spark-fips-3.5 | 3.5.8-r9 |
| chainguard | spark-fips-4.1 | 4.1.2-r9 |
| chainguard | spark-fips-4.2 | 4.2.0-r9 |
| chainguard | strimzi-kafka-operator | 1.2.0-r4 |
| chainguard | tez | 0.10.5-r30 |
| chainguard | trino | 483-r7 |
| chainguard | zookeeper-3.8 | 3.8.6-r15 |
| chainguard | zookeeper-3.9 | 3.9.5-r14 |
| chainguard | zookeeper-fips-3.8 | 3.8.6-r14 |
| chainguard | zookeeper-fips-3.9 | 3.9.5-r10 |
| debian 11 | netty | no fix listed |
| debian 12 | netty | no fix listed |
| debian 13 | netty | no fix listed |
| debian 14 | netty | no fix listed |
| echo | netty | no fix listed |
| echo maven::Echo OSV | io.netty:netty-handler | 4.1.137.Final |
| minimos | apache-activemq-artemis | 2.56.0-r0 |
| minimos | apache-druid | 38.0.0-r0 |
| minimos | apache-druid-fips | 38.0.0-r0 |
| minimos | apache-hop | 2.19.0-r0 |
| minimos | apache-hop-fips | 2.19.0-r0 |
| minimos | apache-iceberg-sink-connector | 1.12.0-r0 |
| minimos | apache-iceberg-sink-connector-fips | 1.12.0-r0 |
| minimos | apache-nifi | 2.12.0-r0 |
| minimos | apache-nifi-registry | 2.12.0-r0 |
| minimos | apache-polaris | 1.8.0-r0 |
| minimos | apache-polaris-admin-tool | 1.8.0-r0 |
| minimos | apache-polaris-admin-tool-fips | 1.8.0-r0 |
| minimos | apache-polaris-fips | 1.8.0-r0 |
| minimos | apache-pulsar-4.0 | 4.0.14-r0 |
| minimos | apache-pulsar-fips-4.0 | 4.0.14-r0 |
| minimos | camunda-8.8 | 8.8.35-r0 |
| minimos | camunda-8.9 | 8.9.15-r0 |
| minimos | cassandra-reaper-5.0 | 5.0.1-r0 |
| minimos | cloudwatch-exporter | 0.19.0-r0 |
| minimos | datahub-frontend-react | 1.7.0.1-r0 |
| minimos | datahub-frontend-react-fips | 1.7.0.1-r0 |
| minimos | datahub-upgrade | 1.7.0.1-r0 |
| minimos | datahub-upgrade-fips | 1.7.0.1-r0 |
| minimos | elasticsearch-8.19 | 8.19.22-r0 |
| minimos | elasticsearch-9.4 | 9.4.8-r0 |
| minimos | elasticsearch-9.5 | 9.5.5-r0 |
| minimos | elasticsearch-fips-8.19 | 8.19.22-r0 |
| minimos | elasticsearch-fips-9.4 | 9.4.8-r0 |
| minimos | elasticsearch-fips-9.5 | 9.5.5-r0 |
| minimos | flyway | 13.7.0-r0 |
| minimos | flyway-fips | 13.4.0-r0 |
| minimos | google-cloud-sdk | 586.0.0-r0 |
| minimos | infinispan-16.0 | 16.0.15-r0 |
| minimos | infinispan-16.2 | 16.2.3-r0 |
| minimos | keycloak | 26.7.5-r0 |
| minimos | keycloak-fips | 26.7.5-r0 |
| minimos | knative-kafka-broker-dispatcher-loom-1.23 | 1.23.1-r0 |
| minimos | knative-kafka-broker-dispatcher-loom-fips-1.23 | 1.23.1-r0 |
| minimos | knative-kafka-broker-receiver-loom-1.23 | 1.23.1-r0 |
| minimos | knative-kafka-broker-receiver-loom-fips-1.23 | 1.23.1-r0 |
| minimos | logstash-8.19 | 8.19.21-r0 |
| minimos | logstash-9.4 | 9.4.6-r0 |
| minimos | logstash-9.5 | 9.5.3-r0 |
| minimos | logstash-input-beats | 7.0.14-r0 |
| minimos | logstash-input-http | 4.2.1-r0 |
| minimos | logstash-input-tcp | 7.0.13-r0 |
| minimos | management-api-5.0 | 0.1.125-r0 |
| minimos | management-api-fips-5.0 | 0.1.125-r0 |
| minimos | neo4j-5.26 | 5.26.30-r0 |
| minimos | nessie | 0.108.8-r0 |
| minimos | nessie-fips | 0.108.8-r0 |
| minimos | nexus3 | 3.96.0.09-r0 |
| minimos | nexus3-fips | 3.96.0.09-r0 |
| minimos | opensearch-3 | 3.9.0-r0 |
| minimos | strimzi-kafka-bridge | 1.0.0-r1 |
| minimos | strimzi-kafka-bridge-fips | 1.1.0-r0 |
| minimos | strimzi-kafka-operator-fips | 1.2.0-r0 |
| minimos | trino-fips | 484-r0 |
| minimos | zookeeper-3.8 | 3.8.7-r0 |
| minimos | zookeeper-3.9 | 3.9.6-r0 |
| rapidfort debian 12 | netty | no fix listed |
| rapidfort debian 13 | netty | no fix listed |
| Red Hat | candlepin | no fix listed |
| Red Hat | candlepin-selinux | no fix listed |
| Red Hat | libarrow | no fix listed |
| Red Hat | libarrow-doc | no fix listed |
| Red Hat | netty-handler | no fix listed |
| Red Hat | opendaylight | no fix listed |
| Red Hat | parquet-libs | no fix listed |
| seal maven::Seal Security Database | com.amazonaws:aws-java-sdk-bundle | 1.12.781+sp999, 1.12.792+sp999 |
| seal maven::Seal Security Database | com.couchbase.client:core-io | 3.8.0+sp7, 3.9.0+sp3 |
| seal maven::Seal Security Database | io.netty:netty-handler | 4.1.100.Final+sp999, 4.1.101.Final+sp999, 4.1.111.Final+sp3, 4.1.115.Final+sp4, 4.1.117.Final+sp999, 4.1.118.Final+sp2, 4.1.119.Final+sp2, 4.1.128.Final+sp999, 4.1.130.Final+sp2, 4.1.131.Final+sp2, 4.1.94.Final+sp999, 4.1.97.Final+sp999, 4.2.13.Final+sp2, 4.2.6.Final+sp3 |
| seal maven::Seal Security Database | org.apache.arrow:flight-sql-jdbc-driver | 18.3.0+sp4 |
| seal maven::Seal Security Database | org.neo4j:neo4j-jdbc-full-bundle | 6.13.1+sp999 |
| seal maven::Seal Security Database | seal.sp1.com.amazonaws:aws-java-sdk-bundle | 1.12.781+sp999, 1.12.792+sp999 |
| seal maven::Seal Security Database | seal.sp1.com.couchbase.client:core-io | 3.8.0+sp999, 3.9.0+sp999 |
| seal maven::Seal Security Database | seal.sp1.io.netty:netty-handler | 4.1.100.Final+sp999, 4.1.101.Final+sp999, 4.1.111.Final+sp999, 4.1.115.Final+sp999, 4.1.117.Final+sp999, 4.1.118.Final+sp999, 4.1.119.Final+sp999, 4.1.128.Final+sp999, 4.1.130.Final+sp999, 4.1.131.Final+sp999, 4.1.94.Final+sp999, 4.1.97.Final+sp999, 4.2.13.Final+sp999, 4.2.6.Final+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.apache.arrow:flight-sql-jdbc-driver | 18.3.0+sp999 |
| seal maven::Seal Security Database | seal.sp1.org.neo4j:neo4j-jdbc-full-bundle | 6.13.1+sp999 |
| seal maven::Seal Security Database | seal.sp2.com.couchbase.client:core-io | 3.8.0+sp999, 3.9.0+sp999 |
| seal maven::Seal Security Database | seal.sp2.io.netty:netty-handler | 4.1.111.Final+sp999, 4.1.115.Final+sp999, 4.1.97.Final+sp999, 4.2.6.Final+sp999 |
| seal maven::Seal Security Database | seal.sp2.org.apache.arrow:flight-sql-jdbc-driver | 18.3.0+sp999 |
| seal maven::Seal Security Database | seal.sp3.com.couchbase.client:core-io | 3.8.0+sp999 |
| seal maven::Seal Security Database | seal.sp3.io.netty:netty-handler | 4.1.115.Final+sp999 |
| seal maven::Seal Security Database | seal.sp3.org.apache.arrow:flight-sql-jdbc-driver | 18.3.0+sp999 |
| seal maven::Seal Security Database | seal.sp4.com.couchbase.client:core-io | 3.8.0+sp999 |
| seal maven::Seal Security Database | seal.sp5.com.couchbase.client:core-io | 3.8.0+sp999 |
| seal maven::Seal Security Database | seal.sp6.com.couchbase.client:core-io | 3.8.0+sp999 |
| wolfi | akhq | 0.28.0-r8 |
| wolfi | cassandra-5.0 | 5.0.9-r7 |
| wolfi | cassandra-reaper | 5.0.1-r1 |
| wolfi | druid | 37.0.0-r56 |
| wolfi | flyway | 13.6.0-r2 |
| wolfi | keycloak-26.5 | 26.5.7-r7 |
| wolfi | keycloak-26.6 | 26.6.6-r1 |
| wolfi | sonarqube | 26.8.0.126808-r3 |
| wolfi | spark-4.0 | 4.0.4-r4 |
| wolfi | strimzi-kafka-operator | 1.2.0-r4 |
| wolfi | tez | 0.10.5-r30 |
| wolfi | trino | 483-r7 |
| wolfi | zookeeper-3.9 | 3.9.5-r14 |
References
- https://access.redhat.com/security/cve/CVE-2026-75595
- https://advisory.echohq.com/cve/CVE-2026-75595
- https://github.com/netty/netty
- https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7
- https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961
- https://github.com/netty/netty/pull/17213
- https://github.com/netty/netty/pull/17217
- https://github.com/netty/netty/releases/tag/netty-4.1.137.Final