Bug 2560876 (CVE-2026-116542)
| Summary: | CVE-2026-116542 io.netty/netty-tcnative: netty-tcnative: Hostname spoofing via improper SNI character decoding | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | fmariani, gmalinko, janstey, jwon, mcarlett, pdelbell, pjindal, rstepani, tcunning, yfang |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in netty-tcnative. A remote, unauthenticated attacker can exploit this issue by sending a specially crafted Server Name Indication (SNI) hostname with overlong character encodings during a Transport Layer Security (TLS) handshake. This causes the application to decode the hostname inconsistently, resulting in hostname spoofing that can bypass access controls, trigger incorrect certificate selection, or falsify security audit logs.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-10-26 15:31:43 UTC
|