CVE-2026-116542: Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello servername to confuse SNI-based certificate selection, access decisions, and logging.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to practical impact?
Deployments that use the ClientHello server_name for SNI-based certificate selection, access decisions, or logging are exposed to hostname confusion. The issue affects netty-tcnative versions before 2.0.84.Final.
What does an attacker need to exploit this?
An attacker needs only network access to the TLS service and does not need authentication or user interaction. They can send a ClientHello containing modified UTF-8 overlong encodings in the server_name value.
How can I determine whether my application is affected?
Check the resolved version of the Maven artifact io.netty:netty-tcnative used by the application. Versions earlier than 2.0.84.Final are affected.