CVE-2026-116542mediumCWE-176

CVE-2026-116542: falha de média gravidade em netty-tcnative

Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar netty-tcnative+ Monitorar netty-tcnative-boringssl-static

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.2%
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
netty · netty-tcnativenetty · netty-tcnative-boringssl-static
CVEs relacionadas — netty-tcnative

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116541HIGHnetty-tcnative before 2.0.84.Final Denial of Service via BIO Write OvercountEPSS 0.5%CVE-2026-116540HIGHnetty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket CallbackEPSS 0.5%CVE-2026-116539HIGHNetty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIOEPSS 0.4%