Bug 2519953 (CVE-2026-75595)

Summary: CVE-2026-75595 io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: amctagga, anthomas, ant, anujha, aoconnor, aschwart, asoldano, asyoung, aszczucz, ataylor, bbaranow, bbrownin, bmaxwell, bniver, boliveir, bstansbe, ccranfor, cescoffi, cmah, csuconic, dbruscin, dhanak, dlofthou, drichtar, drosa, dsimansk, eglynn, ehelms, ehugonne, ewittman, flucifre, fmariani, fmongiar, ggainey, gmalinko, gmeno, groman, gsmet, gtanzill, gtully, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jjoyce, jmartisk, jnethert, jpasqual, jpechane, jpretori, jschluet, jsherman, juwatts, jwon, kaycoth, kingland, kvanderr, lhh, manderse, mbenjamin, mburns, mcarlett, mdellweg, mgarciac, mhackett, mhulan, mnovotny, mosmerov, mposolda, msvehla, nipatil, nmoumoul, nwallace, olubyans, osousa, ozzy, pantinor, pberan, pcreech, pdelbell, pesilva, pjindal, pmackay, prichard, rchan, rgemmell, rgodfrey, rguimara, rkubis, rmartinc, rstancel, rstepani, sausingh, sbiarozk, sdawley, smallamp, sostapov, ssilvert, sthirugn, sthorger, tbish, tcunning, thjenkin, tlavocat, tmalecek, varjain, vdosoudi, vereddy, vmuzikar, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-19 21:26:52 UTC 
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Comment 3 Jon Orris 2026-09-24 19:57:45 UTC 
This issue has been addressed in the following products:

  Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16

Via RHSA-2026:71675 https://access.redhat.com/errata/RHSA-2026:71675