CVE-2026-75596
ADVISORY - githubSummary
Summary
Netty's default SNI entrypoint reparses and recopies previously received ClientHello fragments on every additional TLS handshake record. A remote peer can send a small first record that advertises a large ClientHello length and then drip the body in many tiny records, causing superlinear (quadratic) CPU work before the handshake completes. With 4095 one-byte fragments, the handler recopies 8,386,560 bytes from only 24,579 bytes on the wire — a 341× amplification ratio.
Affected Entrypoints
io.netty.handler.ssl.SniHandler— default constructorsio.netty.handler.ssl.SslClientHelloHandler— pre-handshake ClientHello aggregation path
Vulnerable Code Locations
handler/src/main/java/io/netty/handler/ssl/SniHandler.java:85handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:75(decode entry)handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:165(handshakeBuffer.clear)handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java:174(writeBytes re-copy)codec-base/src/main/java/io/netty/handler/codec/ByteToMessageDecoder.java:294(cumulation retention)
Exploit Path
1. TCP connection → SniHandler → SslClientHelloHandler.decode
2. First record: TLS handshake header declaring large ClientHello length (e.g., 4096 bytes)
3. Attacker sends thousands of tiny follow-on handshake records (1 byte each)
4. On each fragment: handshakeBuffer.clear() + writeBytes() re-copies ALL accumulated body bytes
5. Total bytes copied = n*(n+1)/2 where n = number of body bytes → quadratic
6. Event-loop CPU exhausted before SslHandler takes over
Impact
- Vulnerability Type: Inefficient Algorithmic Complexity
- An unauthenticated network attacker can drive disproportionate CPU consumption on the Netty event loop
- Affects all Netty deployments using
SniHandlerfor TLS termination (the default SNI path) - No privileges, user interaction, or special configuration required
- Can degrade or stall TLS connection handling for all clients on the affected event loop
- The attack requires only modest bandwidth (~25 KB) to trigger significant CPU work
Credits
Found by a security research team from the University of Sydney, focusing on detecting open source software vulnerabilities. Liyi Zhou: https://lzhou1110.github.io/ Ziyue Wang: https://zyy0530.github.io/ Strick: https://str1ckl4nd.github.io/ Maurice: https://maurice.busystar.org/ Chenchen Yu: https://7thparkk.github.io/
Common Weakness Enumeration (CWE)
Inefficient Algorithmic Complexity
Inefficient Algorithmic Complexity
NIST
3.9
CVSS SCORE
8.7highGitHub
-
CVSS SCORE
6.9mediumDebian
-
Ubuntu
3.9
CVSS SCORE
7.5mediumChainguard
CGA-gh56-7g78-cf6f
-
minimos
MINI-2wcq-j599-xcrc
-
minimos
MINI-32rf-23mg-c6q4
-
minimos
MINI-3497-rgmq-fqgr
-
minimos
MINI-34vg-fwcq-w6v6
-
minimos
MINI-3pwh-r8jx-9rcj
-
minimos
MINI-3rh7-2783-5gc5
-
minimos
MINI-44c6-2v9q-hxrj
-
minimos
MINI-4cw3-p9hp-g845
-
minimos
MINI-4pw6-58r5-85q2
-
minimos
MINI-52x5-w7cr-j43m
-
minimos
MINI-53cp-fq22-px8x
-
minimos
MINI-53w4-qcc2-rcqc
-
minimos
MINI-58f9-vjq5-gppm
-
minimos
MINI-5j7q-q382-7m26
-
minimos
MINI-5xcr-mcmw-43cg
-
minimos
MINI-6358-6q6r-9424
-
minimos
MINI-64pj-xxh6-4xrq
-
minimos
MINI-6hgp-3mj9-2ff9
-
minimos
MINI-6pj5-qw7g-5vvh
-
minimos
MINI-6rqx-3r9h-3m64
-
minimos
MINI-7363-v7cm-qx43
-
minimos
MINI-7627-vw2r-2jg3
-
minimos
MINI-78c8-wx48-7wh9
-
minimos
MINI-78cj-3r8v-3pmv
-
minimos
MINI-7fmc-rw26-3fm4
-
minimos
MINI-7jq4-p6r5-q8qp
-
minimos
MINI-7v48-xxwx-j89p
-
minimos
MINI-7vh9-f6rm-fjh4
-
minimos
MINI-849c-xp5f-38p2
-
minimos
MINI-85q2-ch5j-qx2j
-
minimos
MINI-868w-prcr-32v7
-
minimos
MINI-8j74-pfvh-q8vw
-
minimos
MINI-8pw8-q3pf-3fq4
-
minimos
MINI-8wrj-ff7x-p7x7
-
minimos
MINI-92rj-h525-64j3
-
minimos
MINI-959g-gpww-3fj4
-
minimos
MINI-98m9-94qh-2vg7
-
minimos
MINI-9h7v-296h-6g8f
-
minimos
MINI-9vvv-vm58-24mc
-
minimos
MINI-9xmc-q25g-phc7
-
minimos
MINI-c2xc-g6ph-9vf3
-
minimos
MINI-c4f9-pr8v-7phx
-
minimos
MINI-c588-4qqv-4rjh
-
minimos
MINI-f3m8-cpfx-x578
-
minimos
MINI-f779-rj2w-h463
-
minimos
MINI-fghq-xf3j-ff93
-
minimos
MINI-fhrx-q9gj-334p
-
minimos
MINI-fp7f-c7f3-rm38
-
minimos
MINI-fqpc-jqj7-gjcv
-
minimos
MINI-frrv-p37j-gp9g
-
minimos
MINI-fw8p-99h8-r8q4
-
minimos
MINI-g3v8-mh9v-hj59
-
minimos
MINI-g5cr-qg3c-7wrw
-
minimos
MINI-gf4w-j7gr-h2x5
-
minimos
MINI-gq2h-548x-wgm8
-
minimos
MINI-h35j-652r-prhx
-
minimos
MINI-h6g2-9j64-82cc
-
minimos
MINI-hc4r-g8xm-m5w3
-
minimos
MINI-hfv9-jhv7-3272
-
minimos
MINI-hq88-h9rc-m5xq
-
minimos
MINI-hxc8-v22f-rpv9
-
minimos
MINI-j6g7-rpch-qh2p
-
minimos
MINI-j6rq-75fq-cpxv
-
minimos
MINI-j7jm-jr3p-4q4r
-
minimos
MINI-j9mc-6ph6-pvfg
-
minimos
MINI-jghg-3465-fpvr
-
minimos
MINI-jpr3-gjg7-9gh4
-
minimos
MINI-jvm8-5x7h-r83c
-
minimos
MINI-m8qm-mrmv-cx54
-
minimos
MINI-mg7f-4vrc-fjp7
-
minimos
MINI-mmh2-53c7-hhxq
-
minimos
MINI-mpj8-hhmc-vx3c
-
minimos
MINI-p393-6cf5-xr5f
-
minimos
MINI-p4wh-rwx9-gv8c
-
minimos
MINI-p7ch-cq8p-pq6g
-
minimos
MINI-ppp4-w4pr-78c7
-
minimos
MINI-pqxr-c2jv-q7p8
-
minimos
MINI-pvmx-rcww-x9gg
-
minimos
MINI-qgvq-4vxq-c6wp
-
minimos
MINI-qp3m-439r-jm7c
-
minimos
MINI-qw98-777w-92wh
-
minimos
MINI-r5g8-85gp-7gh2
-
minimos
MINI-rgw9-9qgc-65gr
-
minimos
MINI-v775-93qw-jr97
-
minimos
MINI-v7w8-7m57-c6r6
-
minimos
MINI-vqff-9hf5-mj5h
-
minimos
MINI-wfwh-j947-q68r
-
minimos
MINI-wm62-4p5g-f75f
-
minimos
MINI-wqrf-7r6q-2xp8
-
minimos
MINI-wrc9-89ch-vjrq
-
minimos
MINI-wrfq-vgcw-6h4q
-
minimos
MINI-wrh6-63r4-px6j
-
minimos
MINI-wv38-5hhr-2h27
-
minimos
MINI-wxr4-qr87-m684
-
minimos
MINI-x23c-xvm3-6g8m
-
minimos
MINI-x3f4-wc2w-29mp
-
minimos
MINI-xp3m-vg58-34h6
-