CVE-2026-75596

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.137.Final Netty versions prior to 4.2.17.Final

Description An unauthenticated remote peer can cause quadratic CPU work on the event loop by advertising a large ClientHello and delivering its body in thousands of tiny records. This occurs because the default io.netty.handler.ssl.SniHandler constructors use a pre-handshake ClientHello aggregation path in the decode() function of io.netty.handler.ssl.SslClientHelloHandler, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. This behavior can degrade TLS handling for other clients before the TLS handshake completes.

Recommendations Update to version 4.1.137.Final or later. Update to version 4.2.17.Final or later.