UBUNTU-CVE-2026-116539: Buffer Overflow
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcnwritetobytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Deployments using affected netty-tcnative versions in a TLS endpoint that accepts connections from remote TLS peers are exposed. A remote peer can send handshake, renegotiation, or post-handshake messages that reach the vulnerable buffer handling.
Does exploitation require credentials or user interaction?
No privileges or user interaction are required according to the provided vector. The attack complexity is rated high.
What is the operational impact of a successful attack?
Successful exploitation can trigger an out-of-bounds memcpy and crash the JVM process, resulting in a denial of service. The provided impact ratings identify availability impact only, with no confidentiality or integrity impact.
How can I identify affected installations?
Installations running netty-tcnative versions before 2.0.84.Final are affected.