CVE-2026-75595 netty CVE debrief

Who should care

Defenders responsible for Netty deployments, especially those using mutual TLS with per-SNI clientAuth=REQUIRE configurations, should assess their exposure and prioritize updating to fixed versions of Netty. This includes reviewing the current Netty version, understanding the TLS configuration, and ensuring that application-layer certificate verification is properly implemented.

Why it matters

CVE-2026-75595 is a critical vulnerability in Netty that allows unauthenticated remote attackers to bypass mutual TLS requirements under specific conditions. Defenders should prioritize updating to fixed versions and review their TLS configurations to prevent potential unauthorized access.

• Unauthenticated remote attackers can bypass mutual TLS requirements in certain Netty configurations.
• Potential for unauthorized access to protected routes if per-SNI clientAuth=REQUIRE is solely relied upon.
• Need for verification of current Netty version and TLS configuration.
• Priority on updating to fixed Netty versions to prevent exploitation.

Technical summary

The SslClientHelloHandler#decode method in Netty incorrectly checks the offset before reading the four-byte TLS handshake header. This can cause an IndexOutOfBoundsException and lead to the selection of a default SslContext instead of an SNI-specific context. In certain configurations where per-SNI clientAuth=REQUIRE is used as the sole mutual TLS gate, and the default SslContext has less stringent authentication requirements, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement.

Defensive priority

High priority should be given to updating Netty to versions 4.1.137.Final or 4.2.17.Final, or later, as these versions include fixes for the vulnerability. Additionally, defenders should review their deployments to ensure that per-SNI clientAuth=REQUIRE is properly configured and that application-layer certificate verification is in place where necessary.

Recommended defensive actions

• Update Netty to version 4.1.137.Final or 4.2.17.Final, or later.
• Review and ensure proper configuration of per-SNI clientAuth=REQUIRE.
• Implement application-layer certificate verification where necessary.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and associated source references provide details on the vulnerability, including its existence in Netty versions prior to 4.1.137.Final and 4.2.17.Final, and the specific conditions under which an attacker could exploit it. However, there is limited information on actual exploitation or specific attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.