Netty fixes 22 flaws including SNI memory-exhaustion DoS

Netty published a broad set of security advisories covering 22 vulnerabilities across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling. Reported consequences include uncontrolled memory allocation, ByteBuf and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse.

One of the most serious flaws, CVE-2026-45416, allows a remote attacker to send as little as nine bytes in a crafted TLS ClientHello and trigger roughly 16 MiB of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects Netty 4.1.x before 4.1.135.Final and 4.2.0.Final through 4.2.14.Final, and was fixed in 4.1.135.Final and 4.2.15.Final; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.