Listen to this Post
CVE-2026-75595 is a critical authentication bypass vulnerability in the Netty framework, specifically within its `netty-handler` module. The flaw resides in the `io.netty.handler.ssl.SslClientHelloHandlerdecode` method, which is responsible for parsing incoming TLS ClientHello messages during the initial handshake phase.
The vulnerability arises from an incorrect offset check when the handler attempts to read the 4-byte TLS handshake header. The guard logic intended to wait for these 4 bytes fails to account for the 5-byte TLS record header that precedes them. Under normal conditions, when the first record’s payload is at least 4 bytes, the handshake length is parsed correctly. However, when a TLS ClientHello is fragmented across multiple records and the first record’s payload is less than 4 bytes, the code attempts to read the handshake length at an incorrect offset:
handshakeLength = in.getUnsignedMedium(readerIndex + SslUtils.SSL_RECORD_HEADER_LENGTH + 1);
This miscalculation leads to an IndexOutOfBoundsException. Critically, this exception is caught by a generic `catch (Exception)` block, which then calls select(ctx, null). This action forces Netty to silently fall back to the default `SslContext` instead of selecting the correct, SNI-specific context that would have been chosen based on the requested hostname.
The security impact is severe in deployments where mutual TLS (mTLS) enforcement is based solely on per-SNI `SslContext` selection. In such configurations, the default `SslContext` is often permissive, with `clientAuth` set to `NONE` or OPTIONAL, while the specific per-SNI contexts enforce strict client certificate validation (clientAuth=REQUIRE). By exploiting this flaw, an unauthenticated attacker can force the server to use the permissive default context, thereby bypassing the mTLS requirement entirely and gaining unauthorized access to protected routes. This effectively neutralizes a primary security control in zero-trust architectures or secure API gateways.
DailyCVE Form:
Platform: Netty
Version: <=4.1.136.Final & 4.2.0-4.2.16.Final
Vulnerability: Auth Bypass
Severity: Critical
Date: 2026-08-19
Prediction: Patch already available (4.1.137.Final / 4.2.17.Final)
What Undercode Say:
Analytics:
To check if your Netty dependency is vulnerable, use the following Maven command to inspect your project’s dependency tree:
mvn dependency:tree | grep netty-handler
For a more direct check, you can search for the vulnerable class and method in your deployed JAR files:
find . -name "netty-handler-.jar" -exec sh -c 'echo "Checking: {}"; jar tf {} | grep SslClientHelloHandler.class' \;
To verify the exact version of a Netty JAR:
unzip -p /path/to/netty-handler-4.1.136.Final.jar META-INF/MANIFEST.MF | grep "Implementation-Version"
Exploit: (Educational Purposes!)
An attacker can exploit this vulnerability by crafting a fragmented TLS ClientHello. The key is to split the ClientHello so that the handshake header (the 4 bytes containing the Handshake Type and Length) is not fully contained within the first TLS record.
1. Establish a TCP Connection: Connect to the target Netty server on the TLS/mTLS port.
2. Send a Fragmented TLS Record: Send the first TLS record with a payload of less than 4 bytes. For example, a record containing only the Handshake Type (1 byte) and leaving the 3-byte length for the next record.
3. Trigger the Exception: When Netty processes this incomplete record, the `SslClientHelloHandler` will attempt to read the handshake length from the wrong offset, causing an IndexOutOfBoundsException.
4. Fallback to Default Context: The generic exception handler catches this error and calls select(ctx, null), forcing the server to use the default SslContext.
5. Bypass mTLS: The server proceeds with the handshake using the default context, which is likely configured with `clientAuth=NONE` or OPTIONAL. The attacker can then complete the TLS handshake without presenting a valid client certificate, effectively bypassing the mTLS requirement for the targeted SNI route.
Protection
Upgrade Netty: Immediately upgrade to the patched versions: 4.1.137.Final or later for the 4.1.x line, and 4.2.17.Final or later for the 4.2.x line.
Harden Default Context: As a temporary mitigation, configure the default `SslContext` to enforce the same strict `clientAuth=REQUIRE` policy as your per-SNI contexts. This ensures that a fallback does not weaken security.
Add Application-Level Verification: Implement independent verification of the client certificate at the application layer. Do not rely solely on Netty’s SNI-based `SslContext` selection for mTLS enforcement.
Impact
Authentication Bypass: Complete bypass of mTLS for protected routes.
Unauthorized Access: Unauthenticated attackers can gain access to sensitive backend services and resources.
High CVSS Score: The vulnerability carries a CVSS v4.0 Base Score of 9.1 (Critical), indicating a severe risk.
Wide Scope: Affects all Netty versions prior to the patched releases, impacting numerous applications and services that rely on Netty for TLS/mTLS termination.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
