CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.

• CWE-754

• https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7Patch
• https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961Patch
• https://github.com/netty/netty/pull/17213Issue Tracking, Patch
• https://github.com/netty/netty/pull/17217Issue Tracking, Patch
• https://github.com/netty/netty/releases/tag/netty-4.1.137.FinalRelease Notes
• https://github.com/netty/netty/releases/tag/netty-4.2.17.FinalRelease Notes
• https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5Vendor Advisory

Published

Aug 19, 2026

Last Modified

Oct 26, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75588Mattermost Desktop App versions <=6.2 6.2.2.0 fail to valida…2.6
• CVE-2026-75589Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HM…7.5
• CVE-2026-7559The Affilia – Affiliate Program & Referral Tracking for Word…4.3
• CVE-2026-75592Kirby is an open-source content management system. Prior to …6.9
• CVE-2026-75593BuildKit is a toolkit for converting source code to build ar…7.2
• CVE-2026-75594Kirby is an open-source content management system. Prior to …8.2
• CVE-2026-75596Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-75597pyLoad is a free and open-source download manager written in…5.3
• CVE-2026-75600FreePBX is an open source IP PBX. Prior to version 17.0.9, a…8.8
• CVE-2026-75601Static Web Server (SWS) is a production-ready web server sui…4.3
• CVE-2026-75602OpenList a file list program that supports multiple storage.…6.5
• CVE-2026-75604Next.js is a React framework for building full-stack web app…9