|
ELS
< Back

CVE-2026-75595

Updated on 19 Aug 2026

Severity

9.1 Critical severity

Details

CVSS score
9.1
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Summary

A fragmented TLS ClientHello whose handshake header spans multiple records makes Netty silently fall back to the default SslContext; where per-SNI selection is the sole mTLS gate, an unauthenticated attacker can bypass the route’s mTLS requirement.

Details

In io.netty.handler.ssl.SslClientHelloHandler#decode the guard that should wait for the 4-byte handshake header checks the wrong offset - it ignores the 5-byte record header that precedes it - and therefore never fires:

if (handshakeLength == -1) {
if (readerIndex + 4 &gt; endOffset) {
// Need more data to read HandshakeType and handshakeLength (4 bytes)
return;
}

When the first record’s payload is < 4 bytes, handshakeLength = in.getUnsignedMedium(readerIndex + SslUtils.SSL_RECORD_HEADER_LENGTH + 1); leads to IndexOutOfBoundsException . That is caught by the generic catch (Exception) block, which calls select(ctx, null) - this is the default SslContext. Fallback to default on parse failure is a problem when per-SNI selection is the sole mTLS gate.

Impact

SNI routing bypass. Escalates to an unauthenticated mTLS bypass only when:

  • mTLS is enforced solely via per-SNI SslContext (clientAuth=REQUIRE)
  • the default/fallback SslContext is permissive (clientAuth=NONE/OPTIONAL)
  • no secondary peer-certificate verification exists at the application layer.

Details

Affected product:
Apache CXF , Apache Hadoop , Apache Kafka , Apache Log4j , Apache Maven , Apache Solr , Apache Spark , Eclipse Jetty , Elasticsearch , Netty , Spring , Wildfly , alluxio , amazon-kinesis-client , amqp-10-jms-spring-boot , artemis , async-http-client , avro , aws-sdk-java , aws-sdk-java-v2 , azure-sdk-for-java , azure-search-documents , azure-spring-data-cosmos , bolt-connection-java , bookkeeper , bookkeeper-common-allocator , californium , camel , cassandra-java-driver , catalyst , corda , couchbase-jvm-clients-core-io , couchbase-jvm-clients-java-client , curator , cypher-dsl , distributedlog , docker-java , drill , etcd4j , flink , flink-shaded , flume , googleapis , grpc-java , hbase , hbase-thirdparty , infinispan , jaeger-analytics-java , java-datastore , java-driver , jersey , lettuce , logging-flume , metrics , micrometer , micronaut-core , milo , neo4j-java-driver , neo4j-ogm , olingo-odata4 , pgjdbc-ng , pinecone-java-client , pulsar , qpid-jms , rabbitmq-java-client , rabbitmq-stream-java-client , redisson , ribbon , rsocket-java , rxnetty , sdk-platform-java , stack-core , testcontainers-java , tika , vert.x , zendesk-java-client , zookeeper
Affected packages:
netty-buffer @ 4.1.73.Final (+12880 more)

Fixes