CVE-2026-116542
Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
- State
- Published
- Severity
- 6.9 Medium
- Published
- Oct 26, 2026
- Updated
- Oct 31, 2026
- Reserved
- Oct 26, 2026
Description
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-176 Improper Handling of Unicode Encoding
Affected Products
| Product | Versions |
|---|---|
netty-tcnativenetty |
|
netty-tcnative-boringssl-staticnetty |
|
References
- GitHub Security Advisory (GHSA-2784-hxmm-4hgf)vendor-advisory
- Patch Commitpatch
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L2608technical-description
- netty-tcnative netty-tcnative-parent-2.0.84.Final Release Notesrelease-notes
- https://github.com/netty/netty-tcnativeproduct
- VulnCheck Advisory: Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decodingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.