The vulnerability is a heap buffer overflow in the tcn_write_to_bytebuffer BIO callback of the Netty netty-tcnative library. It stems from a failure to wrap the non‑application ring buffer write index, which allows a remote TLS peer to send handshake, renegotiation, or post‑handshake messages that trigger an out‑of‑bounds memcpy and crash the Java Virtual Machine. The resulting crash disables the application and can be triggered by any externally‑connected TLS client, making the impact a high‑severity denial of service with no immediate promise of code execution.

All instances of Netty netty‑tcnative or netty‑tcnative-boringssl‑static that use a version prior to 2.0.84.Final are affected. Any application that links against those native libraries and accepts TLS connections from untrusted peers is at risk.

The CVSS score of 8.2 indicates a high risk, and because the flaw is reachable from any remote TLS participant, the likelihood of exploitation in exposed services is significant, even though the EPSS score is not provided. The vulnerability is not listed in the CISA KEV catalog, but it remains a critical denial of service concern for systems that cannot be updated immediately.