CVE-2026-75595: Netty vulnerability (CVSS 9.1)

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

Netty≥ 4.2.0 < 4.2.17 · < 4.1.137

Remediation

Fixed in

Netty≥ 4.2.17

Patch & vendor advisories

References

https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7Patch
https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961Patch
https://github.com/netty/netty/pull/17213Issue TrackingPatch
https://github.com/netty/netty/pull/17217Issue TrackingPatch
https://github.com/netty/netty/releases/tag/netty-4.1.137.FinalRelease Notes
https://github.com/netty/netty/releases/tag/netty-4.2.17.FinalRelease Notes
https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5Vendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-75595 being actively exploited?

CVE-2026-75595 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.28%.

How severe is CVE-2026-75595?

CVE-2026-75595 has a CVSS 3.1 base score of 9.1, rated critical. EPSS estimates a 0.28% probability of exploitation.

Which products are affected by CVE-2026-75595?

Affected products include Netty.

How do I fix CVE-2026-75595?

Upgrade affected software to a fixed version, for example Netty 4.2.17 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-75595 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo