The vulnerability (CVE-2026-75596) affects Netty's io.netty.handler.ssl.SniHandler default constructors prior to versions 4.1.137.Final and 4.2.17.Final. The flaw lies in the pre-handshake ClientHello aggregation path where the handshakeBuffer.clear() and writeBytes() methods recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can exploit this by sending a large ClientHello message fragmented into thousands of tiny TLS records, causing quadratic CPU consumption on the event loop before the TLS handshake completes. This results in degraded TLS handling performance for other clients sharing the event loop. The issue is resolved in the specified fixed versions.

An unauthenticated remote attacker can cause high CPU usage on the event loop by sending a specially crafted large ClientHello message fragmented into many small TLS records. This leads to degraded TLS handling performance for other clients, potentially causing denial of service conditions due to resource exhaustion. There is no impact on confidentiality or integrity, only availability is affected.

Upgrade Netty to version 4.1.137.Final or later, or 4.2.17.Final or later, where this issue is fixed. No other mitigation is required as the fix addresses the root cause of the excessive CPU usage during TLS handshake.