CVE-2026-75595

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.137.Final Netty versions prior to 4.2.17.Final

Description An issue exists in the decode() function of io.netty.handler.ssl.SslClientHelloHandler where an incorrect offset is checked before reading the four-byte TLS handshake header. A ClientHello with a handshake header spanning records can trigger an IndexOutOfBoundsException, leading to the invocation of select(ctx, null). This causes the system to select the default SslContext instead of the SNI-specific context. In environments where clientAuth=REQUIRE is the only mutual TLS (mTLS) mechanism and the default SslContext is configured with clientAuth=NONE or clientAuth=OPTIONAL without application-layer certificate verification, an unauthenticated remote attacker can bypass the mTLS requirement for protected routes.

Recommendations Update to version 4.1.137.Final. Update to version 4.2.17.Final.