PT-2026-47607 · Maven · Io.Netty:Netty-Handler

Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-45416

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates ctx.alloc().buffer(handshakeLength) (line 161). The guard at line 140 is handshakeLength > maxClientHelloLength && maxClientHelloLength != 0, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-45416

GHSA-X4GW-5CX5-PGMH

Affected Products

Io.Netty:Netty-Handler

References · 5

• https://osv.dev/vulnerability/GHSA-x4gw-5cx5-pgmh · Vendor Advisory
• https://github.com/netty/netty · Note
• https://github.com/netty/netty/releases/tag/netty-4.1.135.Final · Note
• https://github.com/netty/netty/releases/tag/netty-4.2.15.Final · Note
• https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh · Note