Netty netty‑tcnative before 2.0.84.Final has a denial‑of‑service vulnerability in the tcn_write_to_bytebuffer BIO write callback that reports more bytes consumed than were actually written. This overcount allows a remote TLS 1.3 peer to trigger queued post‑handshake records such as NewSessionTicket or KeyUpdate, causing flights to be truncated, connections to fail, or the Java Virtual Machine process to abort. The result is an interruption of service for applications relying on the affected library.

Products affected are the Netty tcn‑native library and its boringssl static variant, with any version prior to 2.0.84.Final. The issue is relevant for deployments that use these components in a TLS 1.3 context. Users employing older Netty tcn‑native or boringssl static versions should review version numbers and plan for an upgrade if needed.

The CVSS score is 8.2, indicating high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; an adversary merely needs network access to a system that accepts TLS 1.3 connections and can send crafted post‑handshake records to trigger the overcount. No authentication or privileged access is required, making this vulnerability especially dangerous for exposed services.