CVE-2026-116542
Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
| CWE | CWE-176 |
| Vendor | netty |
| Product | netty-tcnative |
| Published | Oct 26, 2026 |
Stay Ahead of the Next One
Get instant alerts for netty netty-tcnative
Be the first to know when new medium vulnerabilities affecting netty netty-tcnative are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
netty / netty-tcnative
0 < 2.0.84.Final
netty / netty-tcnative-boringssl-static
0 < 2.0.84.Final
References
github.com: https://github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgf github.com: https://github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38 github.com: https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L2608 github.com: https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final github.com: https://github.com/netty/netty-tcnative vulncheck.com: https://www.vulncheck.com/advisories/netty-netty-tcnative-before-2.0.84-final-sni-hostname-spoofing-via-modified-utf-8-decoding
Credits
Yu Bao, PayPal Cyber Security Team