GCVE - cpe:2.3:a:netty:netty-tcnative-boringssl-static:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:netty:netty-tcnative-boringssl-static:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Netty (`cbedf89d-28d5-506c-890d-fdc641011f07`)
Product	Netty Tcnative Boringssl Static (`ecee1e80-48e7-5aef-a714-98d59889e3db`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-116541`	vulnerable	2026-11-03 10:15:21.718044	netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount MEDIUM (5.9) Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process. Published: 2026-10-26T14:59:40.847Z Updated: 2026-10-26T19:48:35.492Z Open on db.gcve.eu Reference links https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489 https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ssl.c#L240 https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final https://github.com/netty/netty-tcnative	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-116539`	vulnerable	2026-11-03 10:15:21.521263	Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO MEDIUM (5.9) Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process. Published: 2026-10-26T14:59:39.460Z Updated: 2026-11-02T17:40:46.434Z Open on db.gcve.eu Reference links https://github.com/netty/netty-tcnative/security/advisories/GHSA-gf9q-9mg7-g5qh https://github.com/netty/netty-tcnative/commit/92dd66fd1243d85c05a61288f96367a70260b6b8 https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ssl.c#L199 https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final https://github.com/netty/netty-tcnative	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-116542`	vulnerable	2026-11-03 10:15:21.440930	Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding MEDIUM (5.3) Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging. Published: 2026-10-26T14:59:41.528Z Updated: 2026-10-31T01:27:08.152Z Open on db.gcve.eu Reference links https://github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgf https://github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38 https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L2608 https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final https://github.com/netty/netty-tcnative	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Netty Tcnative Boringssl Static

Notes

PURL mappings

Vulnerability references

Contribute