Loading vulnerability…
Netty SNI Routing and Mutual TLS Authentication Bypass
CVE-2026-75595 is a fail-open TLS context selection vulnerability in Netty versions before 4.1.137.Final on the 4.1 branch and 4.2.17.Final on the 4.2 branch. The SslClientHelloHandler.decode method checks an incorrect offset before reading the four-byte TLS handshake header. A crafted ClientHello with a handshake header spanning TLS records can trigger an IndexOutOfBoundsException and invoke select(ctx, null), selecting the default SslContext instead of the SNI-specific context. This bypasses SNI-based context selection and can bypass mutual TLS authentication when the default context permits connections without client certificates and no independent certificate verification is performed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can bypass SNI-based TLS context selection. In deployments relying exclusively on an SNI-specific context to require client certificates, exploitation can allow access to protected routes without presenting a client certificate. This can compromise the confidentiality and integrity of resources protected solely by mutual TLS. The CVSS v3 and v4 base scores are 9.1 and indicate high confidentiality and integrity impacts with no availability impact. Actual exposure depends on TLS configuration and independent application access controls.
If you can’t patch tonight, do this now.
Do not rely solely on per-SNI TLS context selection to enforce mutual TLS. Configure the default or fallback SslContext to require client authentication where appropriate, and independently verify the authenticated peer certificate at the application layer before granting access to protected resources.
Patch, then assume compromise.
Upgrade Netty netty-handler and corresponding Netty dependencies to 4.1.137.Final or later on the 4.1 branch, or 4.2.17.Final or later on the 4.2 branch. For products bundling Netty, install the applicable vendor security release rather than replacing bundled dependencies independently. Identified fixed product releases include Confluence 9.2.26, 10.2.19, or 11.0.0; Jira Service Management 10.3.25 or 11.3.11; and MongoDB Ops Manager Server 8.0.27. HCL Traveler 14.5.0.0 removes the affected Netty dependency.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.