Loading vulnerability…
CVE-2026-45416 is a denial-of-service vulnerability in Netty's TLS/SNI handling within io.netty:netty-handler. In affected versions, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length from a ClientHello and, when the full ClientHello is not present in the first TLS record, eagerly allocates a buffer sized to the attacker-controlled handshake length. The vulnerable path uses ctx.alloc().buffer(handshakeLength), allowing allocation up to the maximum 24-bit handshake size. The intended oversized-message guard only applies when maxClientHelloLength is nonzero, but commonly used SniHandler and AbstractSniHandler default constructors set maxClientHelloLength to 0, effectively disabling the limit. Those same defaults also set the handshake timeout to 0, so no timeout is scheduled to reclaim the allocation if the handshake stalls. As a result, a crafted fragmented TLS ClientHello can trigger immediate large direct-memory allocation that is retained until the connection closes. The issue affects Netty 4.1.x before 4.1.135.Final and 4.2.0.Final through 4.2.14.Final.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A denial-of-service vulnerability in Netty's SslClientHelloHandler/SNI handling that allows a crafted TLS ClientHello to trigger large direct-memory allocation due to a disabled length guard and no handshake timeout.
A Netty TLS parsing denial-of-service vulnerability caused by uncontrolled memory allocation in SslClientHelloHandler.decode() for oversized fragmented ClientHello messages.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.