io.netty:netty-tcnative vulnerabilities
CVEs whose affected-version data names the io.netty:netty-tcnative package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-116539Medium· 5.9Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshak…
CVE-2026-116541Medium· 5.9netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like Ne…
CVE-2026-116542Medium· 5.3Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in…
CVE-2026-116540Medium· 5.9netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTi…