CVE-2026-116542

5.3 MEDIUMpublic exploit available

Published 2026-10-26 · Updated 2026-10-26

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-176

Public exploit & PoC references

https://github.com/netty/netty-tcnative
https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L2608
https://github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38
https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
https://github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgf

All references

https://github.com/netty/netty-tcnative
https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/sslcontext.c#L2608
https://github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38
https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final
https://github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgf
https://www.vulncheck.com/advisories/netty-netty-tcnative-before-2.0.84-final-sni-hostname-spoofing-via-modified-utf-8-decoding

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-105241PoC
UNSCOREDCVE-2026-110674PoC
UNSCOREDCVE-2026-110687PoC
MEDIUMCVE-2026-114114PoC
MEDIUMCVE-2026-19954PoC
UNSCOREDCVE-2026-86105
HIGHCVE-2026-89074
MEDIUMCVE-2026-93751PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.