{"id":"CVE-2026-75596","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-75596","generatedAt":"2026-10-28T02:55:26.520Z","title":"An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients.","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","published":"2026-08-19T21:17:38.000Z","lastModified":"2026-10-26T10:10:00.000Z","status":"Analyzed","sourceIdentifier":"security-advisories@github.com","cvss":{"version":"4.0","score":8.7,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-407"],"affected":["netty/netty"],"epss":{"score":0.00374,"percentile":0.31101,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","tags":["Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/pull/17213","tags":["Issue Tracking","Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/pull/17217","tags":["Issue Tracking","Patch"],"source":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","tags":["Release Notes"],"source":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","tags":["Release Notes"],"source":"security-advisories@github.com"},{"url":"https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","tags":["Vendor Advisory"],"source":"security-advisories@github.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}