io.netty:netty-tcnative-boringssl-static vulnerabilities
CVEs whose affected-version data names the io.netty:netty-tcnative-boringssl-static package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-116539Medium· 5.9PoCNetty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshak…
CVE-2026-116541Medium· 5.9netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like Ne…
CVE-2026-116542Medium· 5.3PoCNetty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in…