Netty netty-tcnative: Denial of service via BIO write overcount
Summary
netty-tcnative, the native TLS library used by Java applications built on Netty, overreports the bytes consumed in its BIO write callback. A remote TLS 1.3 peer can trigger this by sending post-handshake records such as NewSessionTicket or KeyUpdate, which can truncate handshake flights, fail connections or abort the JVM process. No authentication is required. The GitHub advisory additionally describes silent data corruption on the wire, which the CVSS 4.0 vector does not reflect.
Affected
- io.netty:netty-tcnative before 2.0.84.Final
- io.netty:netty-tcnative-boringssl-static before 2.0.84.Final
- The GitHub advisory names 2.0.81.Final as a tested affected version across BoringSSL, OpenSSL, LibreSSL and AWS-LC backends.
- Downstream Java applications that bundle an older netty-tcnative are also affected.
Fixed in
- Upgrade to netty-tcnative 2.0.84.Final or later.
- Fix commit: e31df4a5885b35085fdfa3e2dca7c1f705d4745b
- Distribution packages: SUSE lists netty-tcnative 2.0.84-150200.3.51.1; confirm CVE coverage in the advisory.
Workaround
Unknown. No vendor-documented workaround exists. Restricting network exposure of affected TLS endpoints is a reasonable interim step until patching.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found; this is unverified.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
Our recommendation
- Inventory Maven and Gradle dependencies and vendor appliances for netty-tcnative below 2.0.84.Final.
- Prioritise internet-facing Java services such as portals, integration gateways, message brokers and data pipelines.
- Update to 2.0.84.Final or later and redeploy affected applications.
- Monitor for JVM crashes and dropped TLS connections until patched.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA advisory GHSA-9xr3-jwv4-r489 github.com
- VulnCheck advisory www.vulncheck.com
- Ubuntu CVE tracker ubuntu.com
- Release 2.0.84.Final github.com
- Fix commit e31df4a5 github.com
- SUSE advisory SUSE-SU-2026:4391-1 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 14:55.
Original description (NVD)
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.
NVD references (6)
- https://github.com/netty/netty-tcnative
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ss…
- https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b
- https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
- https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489
- https://www.vulncheck.com/advisories/netty-tcnative-before-2.0.84-final-denial-of-service-via-bio-write-overc…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.