CVE-2026-116542mediumCWE-176

CVE-2026-116542: fallo de gravedad media en netty-tcnative

Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear netty-tcnative+ Monitorear netty-tcnative-boringssl-static

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.2%
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Productos afectados
netty · netty-tcnativenetty · netty-tcnative-boringssl-static
CVEs relacionadas — netty-tcnative

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-116541HIGHnetty-tcnative before 2.0.84.Final Denial of Service via BIO Write OvercountEPSS 0.5%CVE-2026-116540HIGHnetty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket CallbackEPSS 0.5%CVE-2026-116539HIGHNetty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIOEPSS 0.4%