Netty Framework: Nine Vulnerabilities Disclosed, Including DoS and Information Exposure
A batch of nine vulnerabilities, ranging from Medium to Critical, were disclosed in the Netty network framework from August 19-22, 2026, affecting SOCKS, TLS, and oHTTP components.
Key findings
- Nine vulnerabilities disclosed in Netty framework between August 19-22, 2026, impacting SOCKS, TLS, and oHTTP components.
- Multiple critical and high-severity DoS vulnerabilities found in the netty-incubator-codec-ohttp BinaryHttpParser.
- Issues in SOCKS encoders (CVE-2026-62380) and TLS hostname verification (CVE-2026-62243) pose risks of injection and MITM attacks.
- Critical vulnerabilities in SslClientHelloHandler (CVE-2026-75595, CVE-2026-75596) can lead to index out-of-bounds exceptions.
- HPKE private key bytes exposed via toString() and exceptions in CVE-2026-61798.
- Patches are available in Netty versions 4.1.137.Final and 4.2.17.Final.
On August 19-22, 2026, a batch of nine vulnerabilities was disclosed in the Netty network application framework. These vulnerabilities span several components, including SOCKS encoders, TLS handling, and the experimental oHTTP codec, with severities ranging from Medium to Critical. The disclosures highlight issues such as improper input validation, denial-of-service (DoS) vulnerabilities, and potential information exposure.
Several vulnerabilities were found in the netty-incubator-codec-ohttp component, specifically within its BinaryHttpParser. CVE-2026-63202, CVE-2026-61827, and CVE-2026-63124 all relate to CPU-exhaustion DoS attacks. CVE-2026-63202 involves an infinite loop in field-section decoding due to a lack of exit condition validation. CVE-2026-61827 addresses the failure to enforce limits on variable-length fields, allowing attackers to cause buffer overflows and potential OutOfMemory errors. Similarly, CVE-2026-63124 describes an infinite loop triggered by a malformed known-length Binary HTTP field section. Another oHTTP-related vulnerability, CVE-2026-61799, is an unchecked varint length overflow that can lead to a decoder crash due to integer overflow when processing attacker-controlled lengths.
Further issues were identified in Netty's core handlers. CVE-2026-62380, affecting the SOCKS4 and SOCKS5 client encoders, contains null byte, CRLF, and credential injection vulnerabilities due to insufficient validation of domain addresses and authentication details. CVE-2026-62243, impacting the SslProvider.OPENSSL client path, disables TLS hostname verification under specific configurations involving a plain X509TrustManager and unavailable Unsafe-based trust-manager wrapping, potentially allowing man-in-the-middle attacks.
Critical and High severity vulnerabilities were also disclosed on August 19th, concerning Netty's SSL handling. CVE-2026-75596 and CVE-2026-75595 both relate to the SslClientHelloHandler. CVE-2026-75596 involves an issue with the pre-handshake ClientHello aggregation path in default SniHandler constructors. CVE-2026-75595, a critical vulnerability, arises from an incorrect offset check before reading the TLS handshake header in SslClientHelloHandler#decode, which can lead to an IndexOutOfBoundsException when a ClientHello spans across multiple records.
Additionally, CVE-2026-61798, also within the netty-incubator-codec-ohttp-hpke-classes-boringssl component, exposes raw HPKE private key bytes through toString() methods and exception messages, posing a significant risk of sensitive information disclosure.
The affected versions for most of these vulnerabilities are prior to Netty 4.1.137.Final and 4.2.17.Final, with specific ranges mentioned for some CVEs. Patches are available in these later versions. Users of Netty are advised to update to the patched versions to mitigate these security risks. The broad range of affected components and the mix of DoS, information disclosure, and authentication bypass vulnerabilities underscore the importance of timely patching for the Netty framework.