Medium severity5.3NVD Advisory· Published Oct 26, 2026· Updated Oct 26, 2026
CVE-2026-116542
CVE-2026-116542
Description
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <2.0.84.Final
Patches
Vulnerability mechanics
References
5- github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.cnvd
- github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38nvd
- github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Finalnvd
- github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgfnvd
- www.vulncheck.com/advisories/netty-netty-tcnative-before-2.0.84-final-sni-hostname-spoofing-via-modified-utf-8-decodingnvd
News mentions
0No linked articles in our index yet.