Loading vulnerability…
Netty TLS ClientHello Eager Allocation Denial of Service
CVE-2026-45416 is a memory-exhaustion vulnerability in Netty's SslClientHelloHandler.decode(), affecting releases before 4.1.135.Final in the 4.1 branch and 4.2.15.Final in the 4.2 branch. When a TLS ClientHello does not fit in its first record, the handler eagerly allocates a buffer using the attacker-controlled 24-bit handshake length. Common SniHandler and AbstractSniHandler constructors set maxClientHelloLength and handshakeTimeoutMillis to zero, disabling both the length limit and handshake timeout. A declared length approaching 16 MiB triggers an immediate huge/unpooled allocation exceeding the default pooled chunk size. The handler retains the buffer until the channel closes, allowing incomplete TLS handshakes to exhaust memory and deny service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote attackers can induce large memory allocations and retain them across open connections, exhausting the memory available to a Netty application. Repeated or concurrent incomplete handshakes can degrade availability or cause out-of-memory failure and service disruption. No confidentiality or integrity impact is established for this vulnerability.
If you can’t patch tonight, do this now.
Until patched, configure and enforce a non-zero maxClientHelloLength appropriate for legitimate clients, together with a finite handshake timeout. The length limit constrains attacker-triggered buffer allocation; the timeout limits retention by incomplete handshakes. A timeout alone does not prevent the initial eager allocation.
Patch, then assume compromise.
Upgrade io.netty:netty-handler to 4.1.135.Final or later in the 4.1 branch, or 4.2.15.Final or later in the 4.2 branch. Applications consuming Netty through a bundled dependency should install a vendor-supported product update containing the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.