EUVD-2026-63095Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N), but AC:H reflects the required record-spanning ClientHello plus the specific non-default clientAuth configuration; successful bypass yields high confidentiality and integrity impact, no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
AnalysisAI
Mutual-TLS authentication bypass in the Netty network framework (io.netty.handler.ssl.SslClientHelloHandler) lets an unauthenticated remote attacker reach routes protected only by per-SNI clientAuth=REQUIRE. A ClientHello whose 4-byte handshake header is split across TLS records trips a wrong-offset bounds check, throwing IndexOutOfBoundsException and calling select(ctx, null), which falls back to the default SslContext (clientAuth NONE/OPTIONAL) instead of the SNI-matched context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Netty deployment where ALL of the following hold: per-SNI clientAuth=REQUIRE is the sole mutual-TLS gate for the protected route; the default SslContext is configured with clientAuth=NONE or clientAuth=OPTIONAL; and there is no application-layer client-certificate verification as a backstop. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H) rates this 9.1 Critical: network-reachable, no privileges, no user interaction, high confidentiality and integrity impact - but AT:P (Attack Requirements: Present) correctly signals that exploitation depends on conditions outside the attacker's control, namely a specific deployment configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker targets a service that routes TLS by SNI and enforces mutual TLS only via per-SNI clientAuth=REQUIRE on a protected virtual host. The attacker connects and sends a ClientHello deliberately fragmented so the four-byte handshake header spans two TLS records; Netty throws IndexOutOfBoundsException, selects the default SslContext (clientAuth NONE/OPTIONAL), and completes the handshake without ever requiring a client certificate, granting access to the protected route. … |
| Remediation | Vendor-released patch: upgrade to Netty 4.1.137.Final (4.1.x branch) or 4.2.17.Final (4.2.x branch) per GHSA-c4c3-7fpv-j4q5 (https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5); because Netty is usually a transitive dependency, also rebuild/redeploy downstream applications and check shaded or vendored copies. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications and services using Netty 4.1.x or 4.2.x versions prior to 4.1.137.Final and 4.2.17.Final respectively, with priority given to systems using clientAuth=REQUIRE configuration. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today