CVE-2026-116542

Name of the Vulnerable Software and Affected Versions netty-tcnative versions prior to 2.0.84.Final

Description Remote unauthenticated clients can perform SNI hostname spoofing through JNI NewStringUTF decoding. By sending overlong encodings, such as 0xC0 0x80, within the server name of the ClientHello, attackers can manipulate SNI-based certificate selection, access decisions, and logging. Server Name Indication (SNI) is an extension of the TLS protocol that allows a client to specify the hostname it is attempting to connect to during the handshake process.

Recommendations Update netty-tcnative to version 2.0.84.Final or later.