Description
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
netty netty-tcnative
Default version status: unaffected
0 to < 2.0.84.Finalaffected
pkg:maven/io.netty/netty-tcnativenetty netty-tcnative-boringssl-static
Default version status: unaffected
0 to < 2.0.84.Finalaffected
pkg:maven/io.netty/netty-tcnative-boringssl-staticReferences
- https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489 ↗
- https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b ↗
- https://github.com/netty/netty-tcnative/blob/netty-tcnative-parent-2.0.83.Final/openssl-dynamic/src/main/c/ssl.c#L240 ↗
- https://github.com/netty/netty-tcnative/releases/tag/netty-tcnative-parent-2.0.84.Final ↗
- https://github.com/netty/netty-tcnative ↗
- https://www.vulncheck.com/advisories/netty-tcnative-before-2.0.84-final-denial-of-service-via-bio-write-overcount ↗