CVE-2026-45416

Name of the Vulnerable Software and Affected Versions Netty (ionetty:netty-handler) (affected versions not specified)

Description An uncontrolled memory allocation issue exists in the SslClientHelloHandler.decode() function. When a ClientHello does not fit in the first record, the system eagerly allocates memory using ctx.alloc().buffer(handshakeLength) based on the 24-bit TLS handshake length. Because the SniHandler, AbstractSniHandler, and related constructors often set maxClientHelloLength and handshakeTimeoutMillis to 0, the length guard is disabled and no timeout is scheduled. Consequently, a request of 16 MiB or larger exceeds the default pooled chunk size, resulting in an immediate huge or unpooled allocation that is retained until the channel closes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.