CVE-2026-116539: Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcnwritetobytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Maven artifact io.netty:netty-tcnative in versions before 2.0.84.Final are affected. Exposure requires accepting TLS connections from remote peers.
What does an attacker need to exploit it?
An attacker needs to act as a remote TLS peer and send specially crafted handshake, renegotiation, or post-handshake messages. The vector is network-accessible and requires no privileges or user interaction, although exploitation has high attack complexity.
What is the operational impact of successful exploitation?
Successful exploitation can trigger an out-of-bounds memcpy and crash the JVM process. The stated impact is denial of service; no confidentiality or integrity impact is identified.
What is the remediation target?
Update netty-tcnative to 2.0.84.Final or later. Versions before 2.0.84.Final are identified as vulnerable.