CVE-2026-116541: netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
netty-tcnativeto a version that resolves this vulnerability.Fixed in 2.0.84.Final
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Netty netty-tcnative versions before 2.0.84.Final are affected when they communicate with remote TLS 1.3 peers. The impact is denial of service, including failed connections or JVM process aborts.
What does an attacker need to do to trigger the denial of service?
An unauthenticated remote TLS 1.3 peer can provoke queued post-handshake records, such as NewSessionTicket or KeyUpdate. Exploitation depends on the high attack complexity reflected in the supplied vector.
How can teams determine whether they may be affected?
Check whether the application includes netty-tcnative before 2.0.84.Final and establishes TLS 1.3 connections with remote peers. Connection truncation or failures associated with post-handshake TLS records may indicate exposure.