IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
7.5Alta

CVE-2026-45416Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.13.6; Red Hat Red Hat AMQ Broker 7.14.1 Publicada: (hace 5 meses)

Descripción

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Debilidad (CWE): CWE-770

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
amq streams 2.9 —
amq streams 3.2 —
cryostat 4 —
jboss enterprise application platform 8.1 —
jboss enterprise application platform els 7.4 —
netty netty >= 4.2.0.Final, < 4.2.15.Final, < 4.1.135.Final
offline knowledge portal 1.2 —
openshift ai 2.25 —
openshift devspaces 3.30 —
quarkus 3.27 —
quarkus 3.33 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat Red Hat AMQ Broker 7.13.6 —
Red Hat Red Hat AMQ Broker 7.14.1 —
Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1 —
Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 —
Red Hat Red Hat build of Quarkus 3.27.4.SP1 —
Red Hat Red Hat build of Quarkus 3.33.2.SP1 —
Red Hat Red Hat Data Grid 8.6.2 —
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 —
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA all versions
Red Hat Streams for Apache Kafka 2.9.4 —
Red Hat Streams for Apache Kafka 3.2.1 —

Referencias y parches

Coincidencias CPE (NVD) (2)
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.135
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.15