Netty versions before 4.1.137.Final and 4.2.17.Final contain a flaw in the io.netty.handler.ssl.SslClientHelloHandler#decode method where it incorrectly checks the offset before reading the four-byte TLS handshake header. This causes an IndexOutOfBoundsException when a ClientHello message's handshake header spans multiple records, triggering a fallback to the default SslContext rather than the SNI-specific context. If the deployment relies solely on per-SNI clientAuth=REQUIRE for mutual TLS enforcement, and the default SslContext uses clientAuth=NONE or OPTIONAL without additional certificate verification, an unauthenticated remote attacker can bypass mutual TLS protections. The vulnerability is resolved in versions 4.1.137.Final and 4.2.17.Final.

An unauthenticated remote attacker can bypass mutual TLS authentication in affected Netty versions if the deployment relies exclusively on per-SNI clientAuth=REQUIRE and the default SslContext is configured with clientAuth=NONE or OPTIONAL. This allows unauthorized access to protected routes that should require client certificate authentication. The vulnerability does not affect deployments with additional application-layer certificate verification or different clientAuth configurations.

This vulnerability is fixed in Netty versions 4.1.137.Final and 4.2.17.Final. Users should upgrade to these or later versions to remediate the issue. No additional mitigations are indicated by the vendor advisory.