CVE-2026-75596: Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
Netty’s default SNI entrypoint reparses and recopies previously received ClientHello fragments on every additional TLS handshake record. A remote peer can send a small first record that advertises a large ClientHello length and then drip the body in many tiny records, causing superlinear (quadratic) CPU work before the handshake completes. With 4095 one-byte fragments, the handler recopies 8,386,560 bytes from only 24,579 bytes on the wire — a 341× amplification ratio.
References
- github.com/advisories/GHSA-fccg-mwvh-qqg4
- github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7
- github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961
- github.com/netty/netty/pull/17213
- github.com/netty/netty/pull/17217
- github.com/netty/netty/releases/tag/netty-4.1.137.Final
- github.com/netty/netty/releases/tag/netty-4.2.17.Final
- github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4
- nvd.nist.gov/vuln/detail/CVE-2026-75596
Code Behaviors & Features
Detect and mitigate CVE-2026-75596 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →