5.9Orta
CVE-2026-116539Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO
Açıklama
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.
Zayıflık türü (CWE):
CWE-787
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| netty | netty-tcnative | < 2.0.84.Final | |
| netty | netty-tcnative-boringssl-static | < 2.0.84.Final |
Kaynaklar ve yamalar
- GitHub Security Advisory (GHSA-gf9q-9mg7-g5qh) vendor-advisory
- Patch Commit patch
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ss… technical-description
- netty-tcnative netty-tcnative-parent-2.0.84.Final Release Notes release-notes
- https://github.com/netty/netty-tcnative product
- VulnCheck Advisory: Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO third-party-advisory