CVE-2026-116542
Description
A flaw was found in netty-tcnative. A remote, unauthenticated attacker can exploit this issue by sending a specially crafted Server Name Indication (SNI) hostname with overlong character encodings during a Transport Layer Security (TLS) handshake. This causes the application to decode the hostname inconsistently, resulting in hostname spoofing that can bypass access controls, trigger incorrect certificate selection, or falsify security audit logs.
Statement
This vulnerability is rated as Moderate severity because, although exploitable remotely without credentials, it only impacts data integrity without directly exposing confidential information or causing denial of service. Applications bundling netty-tcnative are exposed when terminating TLS connections and relying on the SNI server name to drive routing, multi-tenant certificate selection, or access control policies. In typical Red Hat deployments where SNI is not used as a primary security boundary or where TLS termination is handled by upstream reverse proxies, the practical exposure is further reduced.
Mitigation
Upgrade to netty-tcnative 2.0.84.Final (netty-tcnative-boringssl-static likewise); as a workaround, avoid using the decoded SNI hostname for security decisions, or validate/normalize it before use in access control, routing, or logging.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context; Bypass Protection Mechanism
Attackers can sometimes bypass input validation schemes by finding inputs that appear to be safe, but will be dangerous when processed at a lower layer or by a downstream component. For example, a simple XSS protection mechanism might try to validate that an input has no "<script>" tags using case-sensitive matching (CWE-178), but since HTML is case-insensitive when processed by web browsers, an attacker could inject "<ScrIpT>" and trigger XSS (CWE-79).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
