Netty netty-tcnative: Heap buffer overflow in TLS BIO callback
Summary
netty-tcnative, the Java binding for OpenSSL and BoringSSL used by Netty, contains a heap buffer overflow in its TLS BIO write callback. A remote TLS peer can trigger it without authentication by sending handshake, renegotiation or post-handshake messages, which causes an out-of-bounds memcpy that crashes the JVM process. Java applications that terminate TLS through this library and are reachable over the network are affected. The vendor advisory describes an integer underflow as the root cause, so the real impact may be higher than a crash; this is not yet confirmed.
Affected
- netty-tcnative before 2.0.84.Final
- netty-tcnative-boringssl-static before 2.0.84.Final
- Java applications that bundle either artifact (a dependency, not a standalone product)
Fixed in
- netty-tcnative 2.0.84.Final (vendor fix)
- Distribution packages: fixed versions for Debian and Ubuntu unknown; SUSE lists netty-tcnative 2.0.84-150200.3.51.1
Workaround
- No vendor workaround known.
- For bundled third-party products, ask the vendor for a build with 2.0.84.Final, or override the Netty TLS dependency where the build allows it.
Exploitation
- No exploitation in the wild known; not listed in CISA KEV.
- The vendor advisory describes a deterministic reproduction; a public proof of concept has not been verified.
- Unknown from primary sources.
Our recommendation
- Inventory Java applications for netty-tcnative and netty-tcnative-boringssl-static in JAR files.
- Upgrade to 2.0.84.Final or the vendor's fixed build, starting with internet-facing services.
- Note the scoring discrepancy: NVD is still awaiting analysis, VulnCheck gives 8.2 and Debian gives 5.9.
- Monitor Java services for unexpected crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-gf9q-9mg7-g5qh github.com
- netty-tcnative release 2.0.84.Final github.com
- Fix commit 92dd66fd github.com
- VulnCheck advisory www.vulncheck.com
- Debian OSV entry osv.dev
- Ubuntu security tracker ubuntu.com
- SUSE update SUSE-SU-2026:4391-1 osv.dev
- Maven Central netty-tcnative central.sonatype.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:54.
Original description (NVD)
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.
NVD references (6)
- https://github.com/netty/netty-tcnative
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ss…
- https://github.com/netty/netty-tcnative/commit/92dd66fd1243d85c05a61288f96367a70260b6b8
- https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
- https://github.com/netty/netty-tcnative/security/advisories/GHSA-gf9q-9mg7-g5qh
- https://www.vulncheck.com/advisories/netty-netty-tcnative-before-2.0.84-final-heap-buffer-overflow-via-openss…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.