Vulnerability Description
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/netty/netty-tcnative
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/
- https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f70
- https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.8
- https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489
- https://www.vulncheck.com/advisories/netty-tcnative-before-2.0.84-final-denial-o
FAQ
What is CVE-2026-116541?
CVE-2026-116541 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke ...
How severe is CVE-2026-116541?
CVE-2026-116541 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-116541?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.