UBUNTU-CVE-2026-116541: High severity ubuntu/netty-tcnative vulnerability

Published Oct 26, 2026

Updated

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

Affected Software

7 affected components

ubuntu/netty-tcnative*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade netty/netty-tcnative to a version that resolves this vulnerability.
Fixed in 2.0.84.Final

Event History

Oct 26, 2026

CVE Published

via OSV·04:17 PM

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using netty-tcnative versions earlier than 2.0.84.Final are affected when they communicate with remote TLS 1.3 peers.

What does an attacker need to exploit it?

An attacker needs to act as a remote TLS 1.3 peer and trigger queued post-handshake records, such as NewSessionTicket or KeyUpdate. No authentication or user interaction is required.

How can I recognize possible impact in an affected deployment?

Potential indicators include truncated TLS flights, failed connections, or JVM process aborts during TLS 1.3 communication involving post-handshake records.

UBUNTU-CVE-2026-116541: High severity ubuntu/netty-tcnative vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

How can I recognize possible impact in an affected deployment?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

How can I recognize possible impact in an affected deployment?