DocumentationOverview
About vulnerability
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.Details
- Affected product:
- Netty , Spring , alluxio , applicationinsights-java , arrow , artemis , athenz , aws-sdk-java-v2 , azure-kusto-java , azure-sdk-for-java , azure-search-documents , azure-spring-data-cosmos , bookkeeper , camel , canal , couchbase-jvm-clients , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , debezium , dledger , google-cloud-java , grpc-java , hbase , hbase-thirdparty , ignite , java-logging , micrometer , opencensus-java , org.apache.ratis:ratis-thirdparty-misc , pinecone-java-client , pravega , pulsar , pulsar-client-reactive , ratis , rocketmq , sdk-platform-java , tika , zookeeper
- Affected packages:
- netty-tcnative @ 2.0.29.Final (+12297 more)