CVE-2026-116541
Description
A flaw was found in netty-tcnative. A remote attacker can cause a Denial of Service (DoS) by sending post-handshake messages over a TLS (Transport Layer Security) 1.3 connection. An error in the write callback function, tcn_write_to_bytebuffer, causes it to overreport the number of bytes written, which can truncate message transmissions, drop active connections, or terminate the Java Virtual Machine (JVM) process.
Statement
This vulnerability is rated as Moderate impact for Red Hat products because triggering the denial of service requires an established TLS 1.3 session with specific post-handshake exchange conditions, limiting the failure strictly to availability. In Red Hat middleware environments, such as Red Hat JBoss Fuse and Apache Camel, netty-tcnative serves as an optional native transport engine, meaning exposure is restricted to endpoints utilizing native OpenSSL bindings. Confidentiality and integrity are not compromised, and the issue cannot be leveraged for unauthorized data access or code execution.
Mitigation
Upgrade netty-tcnative to 2.0.84.Final or later; where upgrade is infeasible, disable the native transport (fall back to the JDK SSLEngine implementation) or restrict TLS 1.3 usage.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Unexpected State; Alter Execution Logic
This weakness can lead to unpredictable behavior. If the function is used to make security-critical decisions or provide security-critical information, then the wrong status code can cause the product to assume that an action is safe or correct, even when it is not. This weakness could place the system in a state that could lead unexpected logic to be executed or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
