Denial Of Service (DoS)

io.netty:netty-handler is vulnerable to Denial of Service (DoS) attacks. During TLS handshakes, the SniHandler class can allocate up to 16MB of heap for each channel. The SniHandler is used to establish a TCP server when the handler or channel has no idle timeout. In order to configure an SSL handler using the server name from the ClientHello record, it waits for the TLS handshake. There are no checks to ensure the handshake packet is larger then the data packet, therefore it is possible to create a packet that triggers the “SslClientHelloHandler”, which could be used to cause denial of service through memory exhaustion if there is no idle timeout set.