Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.0.84.Final
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Netty netty-tcnative library, a Java networking component used for TLS/SSL connections, is affected. A remote, unauthenticated attacker can send specially encoded server name values during the TLS handshake so that the hostname is decoded incorrectly, potentially causing the wrong certificate to be selected, access rules to be bypassed, or log entries to be misleading.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- io.netty:netty-tcnative
fixed in 2.0.84.Final
- io.netty:netty-tcnative-boringssl-static
fixed in 2.0.84.Final