Threats affecting pkg:maven/io.netty/netty-tcnative

CVE-2026-116542 is a vulnerability in netty-tcnative before version 2.0.84.Final where improper handling of Unicode encoding in JNI NewStringUTF decoding allows remote unauthenticated clients to spoof SNI hostnames. Attackers can use overlong encodings in the ClientHello server_name field to confuse SNI-based certificate selection, access decisions, and logging.

CVE-2026-116541 is a denial of service vulnerability in netty-tcnative versions before 2.0.84.Final. It arises from an incorrect calculation in the tcn_write_to_bytebuffer BIO write callback, which overreports bytes consumed. Remote TLS 1.3 peers can exploit this to cause truncated flights, connection failures, or JVM process aborts during post-handshake records such as NewSessionTicket or KeyUpdate.

A use-after-free vulnerability exists in netty-tcnative versions 2.0.66.Final through before 2.0.84.Final when built against OpenSSL 3.x. The flaw occurs during TLS session ticket key rotation, where OpenSSL may read freed HMAC keys, potentially causing crashes or corruption in ticket processing.

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.