Netty: Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello… (CVE-2026-45416)

Netty, a network application framework, has a vulnerability in versions before 4.1.135.Final and 4.2.15.Final in the SslClientHelloHandler.decode() method. The method reads the 24-bit TLS handshake length and allocates a buffer of that size eagerly when the ClientHello message does not fit in the first record. The length guard is disabled when maxClientHelloLength is set to 0, which is the default in commonly used SniHandler constructors, allowing large allocations (e.g., 16 MiB) without timeout. The allocated buffer is retained until the channel closes, potentially causing resource exhaustion. The vulnerability is fixed in versions 4.1.135.Final and 4.2.15.Final.

The vulnerability can cause excessive memory allocation and retention in affected Netty versions, potentially leading to denial of service conditions due to resource exhaustion. There is no indication of confidentiality or integrity impact. The CVSS score is 7.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Upgrade to Netty versions 4.1.135.Final or 4.2.15.Final or later where the issue is patched. No other mitigation or workaround is indicated in the advisory.