Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

🗓️ 08 Jun 2026 23:01:04Reported by GitHub Advisory DatabaseType

Netty SniHandler may eagerly allocate up to sixteen MiB for ClientHello data, creating huge unpooled buffers.

Reporter	Title	Published	Views	Family All 201
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	2 Jul 202616:17	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Netty IBM webMethods Managed File Transfer is vulnerable to Improper Access Control and Allocation of Resources without Limits or Throttling	6 Aug 202613:36	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance	10 Aug 202611:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a Resource Allocation Vulnerability in Netty (CVE-2026-45416)	21 Jul 202621:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	18 Jun 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	7 Jul 202619:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.	22 Jul 202607:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	7 Aug 202620:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-handler-4.1.133.Final.jar	30 Jun 202611:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty (CVE-2026-50010,CVE-2026-50020,CVE-2026-45416 & CVE-2026-44249)	10 Jul 202605:11	–	ibm

Vulners

Node

io.netty netty-handlerRange≤4.1.134.Finalmaven

io.netty netty-handlerRange4.2.0.Final–4.2.14.Finalmaven

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh
github	www.github.com/netty/netty/releases/tag/netty-4.1.135.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.15.Final
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45416
github	www.github.com/advisories/GHSA-x4gw-5cx5-pgmh

12 Jun 2026 19:29Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

EPSS0.00856

SSVC

CWE-770