Source: netty-tcnative Version: 2.0.28-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerabilities were published for netty-tcnative. CVE-2026-116539[0]: | Netty netty-tcnative before 2.0.84.Final contains a heap buffer | overflow vulnerability in the tcn_write_to_bytebuffer BIO callback | caused by failing to wrap the non-application ring buffer write | index. Remote TLS peers can drive handshake, renegotiation, or post- | handshake messages into this buffer, triggering an out-of-bounds | memcpy that crashes the JVM process. CVE-2026-116540[1]: | netty-tcnative 2.0.66.Final before 2.0.84.Final built against | OpenSSL 3.x contains a use-after-free vulnerability in | ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote | clients performing TLS handshakes while setSessionTicketKeys0 frees | the shared key array cause OpenSSL to read freed HMAC keys, crashing | or corrupting ticket processing. CVE-2026-116541[2]: | Netty netty-tcnative before 2.0.84.Final contains a denial of | service vulnerability in the tcn_write_to_bytebuffer BIO write | callback that overreports bytes consumed. Remote TLS 1.3 peers can | provoke queued post-handshake records like NewSessionTicket or | KeyUpdate to truncate flights, fail connections, or abort the JVM | process. CVE-2026-116542[3]: | Netty netty-tcnative before 2.0.84.Final contains an SNI hostname | spoofing vulnerability that allows remote unauthenticated clients to | alter hostnames via JNI NewStringUTF decoding. Attackers can send | overlong encodings like 0xC0 0x80 in the ClientHello server_name to | confuse SNI-based certificate selection, access decisions, and | logging. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-116539 https://www.cve.org/CVERecord?id=CVE-2026-116539 [1] https://security-tracker.debian.org/tracker/CVE-2026-116540 https://www.cve.org/CVERecord?id=CVE-2026-116540 [2] https://security-tracker.debian.org/tracker/CVE-2026-116541 https://www.cve.org/CVERecord?id=CVE-2026-116541 [3] https://security-tracker.debian.org/tracker/CVE-2026-116542 https://www.cve.org/CVERecord?id=CVE-2026-116542 Regards, Salvatore
