7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45416

CVE-2026-45416: Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates ctx.alloc().buffer(handshakeLength) (line 161). The guard at line 140 is handshakeLength > maxClientHelloLength && maxClientHelloLength != 0, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45416

CVE-2026-45416:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-handler	maven	>= 4.2.0.Final, <= 4.2.14.Final	4.2.15.Final
io.netty:netty-handler	maven	<= 4.1.134.Final	4.1.135.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a resource exhaustion issue in Netty's SSL/TLS handling logic. The core of the issue lies in the SslClientHelloHandler.decode method, which is responsible for parsing the initial ClientHello message. This method reads the total handshake length from the TLS record and allocates a buffer of that size. A check exists to prevent excessively large allocations (handshakeLength > maxClientHelloLength && maxClientHelloLength != 0), but it could be bypassed.

The vulnerability was exploitable because the SniHandler and AbstractSniHandler classes, which are commonly used for SNI (Server Name Indication) support, were initializing their parent SslClientHelloHandler with a maxClientHelloLength of 0. This value effectively disabled the length validation check.

An attacker could exploit this by sending a specially crafted TLS ClientHello message fragmented into multiple records. The first fragment, as small as nine bytes, could declare a handshake length of up to 16MB (the maximum allowed by the 24-bit length field). The SslClientHelloHandler, with its disabled validation, would then immediately attempt to allocate a 16MB buffer, leading to an OutOfMemoryError and a denial of service.

The patch addresses this by introducing a sane default limit of 64KB for the maxClientHelloLength and ensuring that the SniHandler and AbstractSniHandler constructors use this safe default instead of 0, thereby enabling the crucial length validation.

Vulnerable functions

io.netty.handler.ssl.SslClientHelloHandler.decode

handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java

This function is responsible for decoding the SSL/TLS Client Hello message. It contains the logic that reads the handshake length and allocates a buffer of that size. When configured with a `maxClientHelloLength` of 0, the length validation is disabled, allowing an attacker to trigger an allocation of up to 16 MiB, leading to a denial-of-service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.