EXPOSURES › CVE-2026-75595
CVE-2026-75595
CRITICALA Netty framework bug allowed attackers to bypass mutual TLS authentication by exploiting an offset error that caused the wrong SSL context to be selected.
CVE-2026-75595 in Netty allowed an unauthenticated remote attacker to bypass mutual TLS requirements by exploiting an offset error that caused the wrong SSL context to be selected. DIB organizations must ensure their Netty-based applications are patched to 4.1.137.Final or 4.2.17.Final to prevent attackers from bypassing mutual TLS authentication. This failure highlights the risk of relying on a single mutual TLS gate without application-layer certificate verification.
Shame score — A critical vulnerability in a widely used framework allowed attackers to bypass mutual TLS authentication, which is a fundamental security control for protecting sensitive data.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.