Medium severity · published Oct 26, 2026
CVE-2026-116542
Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
New
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netty-tcnative · netty
before 2.0.84.Final · source: vendor
NE
netty-tcnative-boringssl-static · netty
before 2.0.84.Final · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116542
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116542
github.com
https://github.com/netty/netty-tcnative
github.com
https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L2608
github.com
https://github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38
github.com
https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
github.com
https://github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgf
www.vulncheck.com
https://www.vulncheck.com/advisories/netty-netty-tcnative-before-2.0.84-final-sni-hostname-spoofing-via-modified-utf-8-decoding
More from netty-tcnative
5.9
CVE-2026-116541
netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount
5.9
CVE-2026-116540
netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
5.9
CVE-2026-116539
Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO