---
id: "CVE-2026-116541"
kind: "vulnerability"
aliases: ["CVE-2026-116541"]
title: "Netty tcnative: remote TLS 1.3 peers can crash Java processes"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "jvm-servers", "netty", "package", "tls"]
not_affected_if: ["jdk-ssl-provider", "no-tls-listener"]
published_at: "2026-10-26T16:17:19+00:00"
first_seen_at: "2026-10-26T16:31:01+00:00"
updated_at: "2026-10-26T16:32:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116541", "first_seen_at": "2026-10-26T16:31:01+00:00"}]
---

# Netty tcnative: remote TLS 1.3 peers can crash Java processes

Netty's netty-tcnative library overreports bytes consumed in its TLS write callback, so queued post-handshake records such as NewSessionTicket or KeyUpdate can be mishandled. A remote TLS 1.3 peer can use this to truncate handshake flights, fail connections, or abort the JVM process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find netty-tcnative in the build file or dependency tree and check whether its version is below `2.0.84.Final`.
- Confirm whether the service uses netty-tcnative as its TLS provider, since the flaw is in that library's BIO write callback.

## Fix

- Upgrade netty-tcnative to `2.0.84.Final` or later.
- Rebuild and redeploy services that bundle the library.

## Timeline

- 2026-10-26T16:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116541

## From the sources

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_