CVE-2026-116539
Description
A flaw was found in netty-tcnative. A remote attacker can cause a denial of service (DoS) by sending specially crafted Transport Layer Security (TLS) messages. Due to improper buffer index handling, incoming data triggers a heap-based buffer overflow and an out-of-bounds memory write, which crashes the Java Virtual Machine (JVM) process.
Statement
Red Hat rates the impact of this vulnerability as Moderate because it is restricted to causing a service crash without compromising system confidentiality or data integrity, despite being remotely triggerable without authentication. In Red Hat environments, netty-tcnative is utilized within Java integration runtimes, such as Red Hat JBoss Fuse and Red Hat build of Apache Camel, to provide native OpenSSL-accelerated TLS handling. Successful exploitation requires an active TLS handshake or renegotiation session where non-standard control messages are delivered, resulting in service disruption rather than privilege escalation.
Mitigation
Upgrade netty-tcnative to 2.0.84.Final or later, where the ring-buffer write index is wrapped via modulo of nonApplicationBufferSize in tcn_write_to_bytebuffer (commit 92dd66f). As an interim measure, a larger nonApplicationBufferSize reduces the likelihood of triggering the overflow but is not a fix.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
