CVE-2026-116541

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-116541", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-26T14:30:58.066Z", "datePublished": "2026-10-26T14:59:40.847Z", "dateUpdated": "2026-10-26T19:48:35.492Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T14:59:40.847Z"}, "datePublic": "2026-08-10T00:00:00.000Z", "title": "netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount", "descriptions": [{"lang": "en", "value": "Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Calculation", "cweId": "CWE-682", "type": "CWE"}]}], "affected": [{"vendor": "netty", "product": "netty-tcnative", "collectionURL": "https://repo1.maven.org/maven2/io/netty/netty-tcnative/", "packageName": "io.netty:netty-tcnative", "repo": "https://github.com/netty/netty-tcnative", "defaultStatus": "unaffected", "packageURL": "pkg:maven/io.netty/netty-tcnative", "versions": [{"version": "0", "lessThan": "2.0.84.Final", "status": "affected", "versionType": "custom"}]}, {"vendor": "netty", "product": "netty-tcnative-boringssl-static", "collectionURL": "https://repo1.maven.org/maven2/io/netty/netty-tcnative-boringssl-static/", "packageName": "io.netty:netty-tcnative-boringssl-static", "repo": "https://github.com/netty/netty-tcnative", "defaultStatus": "unaffected", "packageURL": "pkg:maven/io.netty/netty-tcnative-boringssl-static", "versions": [{"version": "0", "lessThan": "2.0.84.Final", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-9xr3-jwv4-r489)"}, {"url": "https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ssl.c#L240", "tags": ["technical-description"]}, {"url": "https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final", "tags": ["release-notes"], "name": "netty-tcnative netty-tcnative-parent-2.0.84.Final Release Notes"}, {"url": "https://github.com/netty/netty-tcnative", "tags": ["product"]}, {"name": "VulnCheck Advisory: netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/netty-tcnative-before-2.0.84-final-denial-of-service-via-bio-write-overcount"}], "credits": [{"lang": "en", "value": "Yu Bao, PayPal Cyber Security Team", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116541", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T19:30:21.899747Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T19:48:35.492Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-116541", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-26T19:30:21.899747Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-26T19:46:15.919Z"}}], "cna": {"title": "netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount", "credits": [{"lang": "en", "type": "finder", "value": "Yu Bao, PayPal Cyber Security Team"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/netty/netty-tcnative", "vendor": "netty", "product": "netty-tcnative", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.84.Final", "versionType": "custom"}], "packageURL": "pkg:maven/io.netty/netty-tcnative", "packageName": "io.netty:netty-tcnative", "collectionURL": "https://repo1.maven.org/maven2/io/netty/netty-tcnative/", "defaultStatus": "unaffected"}, {"repo": "https://github.com/netty/netty-tcnative", "vendor": "netty", "product": "netty-tcnative-boringssl-static", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.84.Final", "versionType": "custom"}], "packageURL": "pkg:maven/io.netty/netty-tcnative-boringssl-static", "packageName": "io.netty:netty-tcnative-boringssl-static", "collectionURL": "https://repo1.maven.org/maven2/io/netty/netty-tcnative-boringssl-static/", "defaultStatus": "unaffected"}], "datePublic": "2026-08-10T00:00:00.000Z", "references": [{"url": "https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489", "name": "GitHub Security Advisory (GHSA-9xr3-jwv4-r489)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ssl.c#L240", "tags": ["technical-description"]}, {"url": "https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final", "name": "netty-tcnative netty-tcnative-parent-2.0.84.Final Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/netty/netty-tcnative", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/netty-tcnative-before-2.0.84-final-denial-of-service-via-bio-write-overcount", "name": "VulnCheck Advisory: netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-682", "description": "Incorrect Calculation"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-26T14:59:40.847Z"}}}, "cveMetadata": {"cveId": "CVE-2026-116541", "state": "PUBLISHED", "dateUpdated": "2026-10-26T19:48:35.492Z", "dateReserved": "2026-10-26T14:30:58.066Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-26T14:59:40.847Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo1.maven.org/maven2/io/netty/netty-tcnative/", "defaultStatus": "unaffected", "packageName": "io.netty:netty-tcnative", "packageURL": "pkg:maven/io.netty/netty-tcnative", "product": "netty-tcnative", "repo": "https://github.com/netty/netty-tcnative", "vendor": "netty", "versions": [{"lessThan": "2.0.84.Final", "status": "affected", "version": "0", "versionType": "custom"}]}, {"collectionURL": "https://repo1.maven.org/maven2/io/netty/netty-tcnative-boringssl-static/", "defaultStatus": "unaffected", "packageName": "io.netty:netty-tcnative-boringssl-static", "packageURL": "pkg:maven/io.netty/netty-tcnative-boringssl-static", "product": "netty-tcnative-boringssl-static", "repo": "https://github.com/netty/netty-tcnative", "vendor": "netty", "versions": [{"lessThan": "2.0.84.Final", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process."}], "id": "CVE-2026-116541", "lastModified": "2026-10-26T20:17:55.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-116541", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-26T19:30:21.899747Z", "version": "2.0.3"}}]}, "published": "2026-10-26T16:17:19.527", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/netty/netty-tcnative"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ssl.c#L240"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/netty-tcnative-before-2.0.84-final-denial-of-service-via-bio-write-overcount"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-682"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "io.netty/netty-tcnative: netty-tcnative: Denial of Service via write callback overreporting", "id": "2560877", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2560877"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-393", "details": ["A flaw was found in netty-tcnative. A remote attacker can cause a Denial of Service (DoS) by sending post-handshake messages over a TLS (Transport Layer Security) 1.3 connection. An error in the write callback function, tcn_write_to_bytebuffer, causes it to overreport the number of bytes written, which can truncate message transmissions, drop active connections, or terminate the Java Virtual Machine (JVM) process."], "mitigation": {"lang": "en:us", "value": "Upgrade netty-tcnative to 2.0.84.Final or later; where upgrade is infeasible, disable the native transport (fall back to the JDK SSLEngine implementation) or restrict TLS 1.3 usage."}, "name": "CVE-2026-116541", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "netty-tcnative", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "netty-tcnative", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-10-26T14:59:40Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-116541\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116541\nhttps://github.com/netty/netty-tcnative\nhttps://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ssl.c#L240\nhttps://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b\nhttps://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final\nhttps://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489\nhttps://www.vulncheck.com/advisories/netty-tcnative-before-2.0.84-final-denial-of-service-via-bio-write-overcount"], "statement": "This vulnerability is rated as Moderate impact for Red Hat products because triggering the denial of service requires an established TLS 1.3 session with specific post-handshake exchange conditions, limiting the failure strictly to availability. In Red Hat middleware environments, such as Red Hat JBoss Fuse and Apache Camel, netty-tcnative serves as an optional native transport engine, meaning exposure is restricted to endpoints utilizing native OpenSSL bindings. Confidentiality and integrity are not compromised, and the issue cannot be leveraged for unauthorized data access or code execution.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0.84.Final)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "netty-tcnative", "source": "cna", "vendor": "netty"}, "product": "netty-tcnative", "vendor": "netty"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0.84.Final)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "netty-tcnative-boringssl-static", "source": "cna", "vendor": "netty"}, "product": "netty-tcnative-boringssl-static", "vendor": "netty"}], "created": "2026-10-26T16:30:11.028808+00:00", "updated": "2026-11-05T02:00:16.255949+00:00", "vendors": ["netty", "netty$PRODUCT$netty-tcnative", "netty$PRODUCT$netty-tcnative-boringssl-static"]}