CVE-2026-75595
Fixed in a distro release EPSS <1%CVSS 9.1
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Products: netty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | io.netty:netty-handler | 4.2.17.Final |
| Maven | io.netty:netty-handler | 4.1.137.Final |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | akhq | 0.28.0-r8 |
| Chainguard | apache-camel-karavan-devmode | 4.18.1-r12 |
| Chainguard | apache-hop | 2.19.0-r3 |
| Chainguard | apache-nifi-2.11 | 2.11.0-r7 |
| Chainguard | cassandra-5.0 | 5.0.9-r7 |
| Chainguard | cassandra-fips-5.0 | 5.0.8-r14 |
| Chainguard | cassandra-reaper | 5.0.1-r1 |
| Chainguard | celeborn-0.5 | no fix |
| Chainguard | celeborn-0.6 | no fix |
| Chainguard | celeborn-0.7 | no fix |
| Chainguard | celeborn-0.7 | 0.7.0-r8 |
| Chainguard | commercial-elasticsearch-8.17 | no fix |
| Chainguard | commercial-elasticsearch-8.19 | 8.19.22-r0 |
| Chainguard | commercial-elasticsearch-9.2 | no fix |
| Chainguard | commercial-elasticsearch-9.3 | no fix |
| Chainguard | commercial-elasticsearch-9.4 | 9.4.8-r0 |
| Chainguard | commercial-elasticsearch-9.5 | 9.5.5-r0 |
| Chainguard | cruise-control-fips-jars | 2.5.146-r5 |
| Chainguard | cruise-control-jars | 2.5.146-r4 |
| Chainguard | drain-cleaner | 1.6.1-r3 |
| Chainguard | drain-cleaner-fips | 1.6.1-r2 |
| Chainguard | druid | 37.0.0-r56 |
| Chainguard | elasticsearch-8.19 | 8.19.21-r1 |
| Chainguard | elasticsearch-8.19-iamguarded-fips | 8.19.21-r1 |
| Chainguard | elasticsearch-9.2 | no fix |
| Chainguard | elasticsearch-9.2-iamguarded-fips | no fix |
| Chainguard | elasticsearch-9.3 | no fix |
| Chainguard | elasticsearch-9.3-iamguarded-fips | no fix |
| Chainguard | elasticsearch-9.4 | 9.4.8-r0 |
| Chainguard | elasticsearch-9.4-iamguarded-fips | 9.4.8-r0 |
| Chainguard | elasticsearch-9.5 | 9.5.5-r0 |
| Chainguard | elasticsearch-9.5-iamguarded | 9.5.3-r1 |
| Chainguard | elasticsearch-9.5-iamguarded-fips | 9.5.5-r0 |
| Chainguard | elasticsearch-fips-8.19 | 8.19.21-r1 |
| Chainguard | elasticsearch-fips-9.2 | no fix |
| Chainguard | elasticsearch-fips-9.3 | no fix |
| Chainguard | elasticsearch-fips-9.4 | 9.4.8-r0 |
| Chainguard | elasticsearch-fips-9.5 | 9.5.5-r0 |
| Chainguard | floci | 2.0.1-r1 |
| Chainguard | floci-az | 0.12.0-r1 |
| Chainguard | flyway | 13.6.0-r2 |
| Chainguard | flyway-fips | 13.6.0-r1 |
| Chainguard | ghidra | 12.1.3-r3 |
| Chainguard | hadoop-3.5 | no fix |
| Chainguard | hadoop-fips-3.3.6 | no fix |
| Chainguard | hadoop-fips-3.4.2 | no fix |
| Chainguard | hadoop-fips-3.5 | 3.5.0-r14 |
| Chainguard | hadoop-fips-3.5 | no fix |
| Chainguard | hono-adapter-mqtt | 2.7.0-r40 |
| Chainguard | hono-cli | 2.7.0-r40 |
| Chainguard | hono-service-auth | 2.7.0-r40 |
| Chainguard | hono-service-command-router | 2.7.0-r40 |
| Chainguard | hono-service-device-registry-jdbc | 2.7.0-r40 |
| Chainguard | kafka-3.7 | 3.7.2-r59 |
| Chainguard | kafka-3.8 | 3.8.1-r61 |
| Chainguard | kafka-3.9 | 3.9.2-r15 |
| Chainguard | kafka-strimzi-compat | 1.2.0-r5 |
| Chainguard | kafka_exporter-strimzi-compat | 1.2.0-r5 |
| Chainguard | kafka_exporter-strimzi-compat | 1.2.0-r4 |
| Chainguard | kayenta-2025.2 | 2025.2.4-r10 |
| Chainguard | kayenta-2025.4 | 2025.4.6-r15 |
| Chainguard | kayenta-2026.0 | no fix |
| Chainguard | kayenta-2026.1 | 2026.1.2-r6 |
| Chainguard | kayenta-fips-2025.2 | no fix |
| Chainguard | kayenta-fips-2025.4 | no fix |
| Chainguard | kayenta-fips-2026.0 | 2026.0.5-r4 |
| Chainguard | kayenta-fips-2026.1 | 2026.1.2-r6 |
| Chainguard | keycloak-26.5 | 26.5.7-r7 |
| Chainguard | keycloak-26.5-iamguarded-compat | 26.5.7-r7 |
| Chainguard | keycloak-26.5-operator | 26.5.7-r7 |
| Chainguard | keycloak-26.6 | 26.6.6-r1 |
| Chainguard | keycloak-26.6-iamguarded-compat | 26.6.6-r1 |
| Chainguard | keycloak-26.6-operator | 26.6.6-r1 |
| Chainguard | keycloak-26.7 | 26.7.3-r1 |
| Chainguard | keycloak-26.7-iamguarded-compat | 26.7.3-r1 |
| Chainguard | keycloak-26.7-operator | 26.7.3-r1 |
| Chainguard | keycloak-fips-26.5 | 26.5.7-r13 |
| Chainguard | keycloak-fips-26.5-iamguarded-fips | 26.5.7-r13 |
| Chainguard | keycloak-fips-26.5-operator | 26.5.7-r13 |
| Chainguard | keycloak-fips-26.6 | 26.6.6-r1 |
| Chainguard | keycloak-fips-26.6-iamguarded-fips | 26.6.6-r1 |
| Chainguard | keycloak-fips-26.6-operator | 26.6.6-r1 |
| Chainguard | keycloak-fips-26.7 | 26.7.3-r1 |
| Chainguard | keycloak-fips-26.7-iamguarded-fips | 26.7.3-r1 |
| Chainguard | keycloak-fips-26.7-operator | 26.7.3-r1 |
| Chainguard | knative-kafka-broker-1.20-dispatcher-loom | 1.20.3-r17 |
| Chainguard | knative-kafka-broker-1.20-receiver-loom | 1.20.3-r17 |
| Chainguard | knative-kafka-broker-1.22-dispatcher-loom | 1.22.3-r13 |
| Chainguard | knative-kafka-broker-1.22-receiver-loom | 1.22.3-r13 |
| Chainguard | knative-kafka-broker-1.23-dispatcher-loom | 1.23.1-r3 |
| Chainguard | knative-kafka-broker-1.23-receiver-loom | 1.23.1-r3 |
| Chainguard | knative-kafka-broker-fips-1.20-dispatcher-loom | 1.20.3-r15 |
| Chainguard | knative-kafka-broker-fips-1.20-receiver-loom | 1.20.3-r15 |
| Chainguard | knative-kafka-broker-fips-1.22-dispatcher-loom | 1.22.3-r9 |
| Chainguard | knative-kafka-broker-fips-1.22-receiver-loom | 1.22.3-r9 |
| Chainguard | knative-kafka-broker-fips-1.23-dispatcher-loom | 1.23.1-r4 |
| Chainguard | knative-kafka-broker-fips-1.23-receiver-loom | 1.23.1-r4 |
| Chainguard | logstash-8.19 | 8.19.21-r0 |
| Chainguard | logstash-8.19-iamguarded-compat | 8.19.21-r0 |
| Chainguard | logstash-8.19-with-output-opensearch | 8.19.21-r0 |
| Chainguard | logstash-9.2 | 9.2.8-r6 |
| Chainguard | logstash-9.2-iamguarded-compat | 9.2.8-r6 |
| Chainguard | logstash-9.2-with-output-opensearch | 9.2.8-r6 |
| Chainguard | logstash-9.3 | no fix |
| Chainguard | logstash-9.3-iamguarded-compat | no fix |
| Chainguard | management-api-for-apache-cassandra-4.0 | 0.1.125-r3 |
| Chainguard | neo4j-2026.02 | 2026.02.3-r4 |
| Chainguard | neo4j-2026.03 | 2026.03.1-r4 |
| Chainguard | pinot | 1.5.1-r19 |
| Chainguard | pinot-fips | 1.5.1-r15 |
| Chainguard | prometheus-jmx-exporter-strimzi-compat | 1.6.0-r0 |
| Chainguard | ranger | no fix |
| Chainguard | request-9047-keycloak-fips-26.4 | no fix |
| Chainguard | request-9047-keycloak-fips-26.5 | 26.5.7-r27 |
| Chainguard | request-9047-keycloak-fips-26.5-iamguarded-fips | 26.5.7-r27 |
| Chainguard | request-9047-keycloak-fips-26.5-operator | 26.5.7-r27 |
| Chainguard | request-9047-keycloak-fips-26.6 | 26.6.6-r2 |
| Chainguard | request-9047-keycloak-fips-26.6-iamguarded-fips | 26.6.6-r2 |
| Chainguard | request-9047-keycloak-fips-26.6-operator | 26.6.6-r2 |
| Chainguard | request-9047-keycloak-fips-26.7 | 26.7.3-r1 |
| Chainguard | request-9047-keycloak-fips-26.7-iamguarded-fips | 26.7.3-r1 |
| Chainguard | request-9047-keycloak-fips-26.7-operator | 26.7.3-r1 |
| Chainguard | seata-server | 2.7.0-r9 |
| Chainguard | sonarqube | 26.8.0.126808-r3 |
| Chainguard | spark-3.5-scala-2.12 | 3.5.9-r5 |
| Chainguard | spark-3.5-scala-2.13 | 3.5.9-r5 |
| Chainguard | spark-4.0-scala-2.13 | 4.0.4-r4 |
| Chainguard | spark-4.2-scala-2.13 | 4.2.0-r10 |
| Chainguard | spark-fips-3.5-scala-2.12 | 3.5.8-r9 |
| Chainguard | spark-fips-3.5-scala-2.13 | 3.5.8-r9 |
| Chainguard | spark-fips-4.1-scala-2.13 | 4.1.2-r9 |
| Chainguard | spark-fips-4.2-scala-2.13 | 4.2.0-r9 |
| Chainguard | strimzi-kafka-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator | no fix |
| Chainguard | strimzi-kafka-operator-cluster-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-cluster-operator | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-kafka-agent | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-base | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-base | no fix |
| Chainguard | strimzi-kafka-operator-kafka-init | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-kafka-init | no fix |
| Chainguard | strimzi-kafka-operator-kafka-init | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs-cc | no fix |
| Chainguard | strimzi-kafka-operator-topic-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-topic-operator | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-tracing-agent | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-user-operator | 1.2.0-r5 |
| Chainguard | tez | 0.10.5-r30 |
| Chainguard | trino-plugin-opensearch | no fix |
| Chainguard | zaproxy | no fix |
| Chainguard | zookeeper-3.8 | 3.8.6-r15 |
| Chainguard | zookeeper-3.9 | 3.9.5-r14 |
| Chainguard | zookeeper-fips-3.8 | 3.8.6-r14 |
| Chainguard | zookeeper-fips-3.9 | 3.9.5-r10 |
| Debian 12 | netty | no fix |
| Debian 13 | netty | no fix |
| Debian 14 | netty | no fix |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | netty | 4.1.138-150200.4.56.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | netty-tcnative | 2.0.84-150200.3.51.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | netty-tcnative | 2.0.84-150200.3.51.1 |
| Ubuntu 26.10 | netty | no fix |
| Ubuntu Pro 14.04 LTS | netty | no fix |
| Ubuntu Pro 16.04 LTS | netty | no fix |
| Ubuntu Pro 18.04 LTS | netty | no fix |
| Ubuntu Pro 20.04 LTS | netty | no fix |
| Ubuntu Pro 22.04 LTS | netty | no fix |
| Ubuntu Pro 24.04 LTS | netty | no fix |
| Ubuntu Pro 26.04 LTS | netty | no fix |
| Wolfi | akhq | 0.28.0-r8 |
| Wolfi | cassandra-5.0 | 5.0.9-r7 |
| Wolfi | cassandra-reaper | 5.0.1-r1 |
| Wolfi | celeborn-0.6 | no fix |
| Wolfi | druid | 37.0.0-r56 |
| Wolfi | flyway | 13.6.0-r2 |
| Wolfi | kafka-strimzi-compat | 1.2.0-r5 |
| Wolfi | kafka_exporter-strimzi-compat | 1.2.0-r5 |
| Wolfi | kafka_exporter-strimzi-compat | 1.2.0-r4 |
| Wolfi | keycloak-26.5 | 26.5.7-r7 |
| Wolfi | keycloak-26.5-iamguarded-compat | 26.5.7-r7 |
| Wolfi | keycloak-26.5-operator | 26.5.7-r7 |
| Wolfi | keycloak-26.6 | 26.6.6-r1 |
| Wolfi | keycloak-26.6-iamguarded-compat | 26.6.6-r1 |
| Wolfi | keycloak-26.6-operator | 26.6.6-r1 |
| Wolfi | logstash-9.3 | no fix |
| Wolfi | logstash-9.3-iamguarded-compat | no fix |
| Wolfi | prometheus-jmx-exporter-strimzi-compat | 1.6.0-r0 |
| Wolfi | sonarqube | 26.8.0.126808-r3 |
| Wolfi | spark-4.0-scala-2.13 | 4.0.4-r4 |
| Wolfi | strimzi-kafka-operator | no fix |
| Wolfi | strimzi-kafka-operator | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-cluster-operator | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-cluster-operator | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-kafka-agent | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-base | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-base | no fix |
| Wolfi | strimzi-kafka-operator-kafka-init | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-kafka-init | no fix |
| Wolfi | strimzi-kafka-operator-kafka-init | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs-cc | no fix |
| Wolfi | strimzi-kafka-operator-topic-operator | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-topic-operator | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-tracing-agent | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-user-operator | 1.2.0-r5 |
| Wolfi | tez | 0.10.5-r30 |
| Wolfi | trino-plugin-opensearch | no fix |
| Wolfi | zookeeper-3.9 | 3.9.5-r14 |
| openSUSE Tumbleweed | netty | 4.1.138-1.1 |