Bug 2560877 (CVE-2026-116541)

Summary: CVE-2026-116541 io.netty/netty-tcnative: netty-tcnative: Denial of Service via write callback overreporting
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fmariani, gmalinko, janstey, jwon, mcarlett, pdelbell, pjindal, rstepani, tcunning, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in netty-tcnative. A remote attacker can cause a Denial of Service (DoS) by sending post-handshake messages over a TLS (Transport Layer Security) 1.3 connection. An error in the write callback function, tcn_write_to_bytebuffer, causes it to overreport the number of bytes written, which can truncate message transmissions, drop active connections, or terminate the Java Virtual Machine (JVM) process.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-26 15:31:48 UTC 
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.