CyberRota Analysis
AI-GeneratedNetty versions prior to 4.1.137.Final and 4.2.17.Final are vulnerable to a flaw in the SslClientHelloHandler that allows an unauthenticated remote attacker to bypass mutual TLS authentication by exploiting an IndexOutOfBoundsException. This vulnerability can lead to unauthorized access to protected routes where client authentication is required, particularly in environments relying on SNI-specific configurations. Organizations using affected versions of Netty should prioritize upgrading to the patched versions to mitigate this critical security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.