Technical impact
The flaw occurs in the JNI implementation of netty‑tcnative when decoding the server_name value from a TLS ClientHello. Overlong UTF‑8 sequences such as 0xC0 0x80 are interpreted incorrectly by the NewStringUTF routine, allowing a remote, unauthenticated client to cause the library to treat a different hostname than the one actually presented. This host spoofing can result in the selection of an unintended certificate and the bypass of host‑based access checks. The description does not explicitly state that data is disclosed, but based on the impact on certificate selection and access control it is inferred that confidentiality or integrity could be at risk.
Affected Systems
Netty netty‑tcnative and netty‑tcnative‑boringssl‑static before 2.0.84.Final are affected. All earlier releases are considered vulnerable until the library is upgraded to 2.0.84.Final or a later version.
Risk and Exploitability
The CVSS score of 6.9 indicates a moderate to high severity. The EPSS score is below 1 %, and the vulnerability is not currently listed in CISA’s KEV. The attack vector is remote, and the flaw can be triggered by any client that can send a crafted TLS ClientHello; authentication is not required. Because the exploit only requires the transmission of a modified SNI hostname, the likelihood of exploitation is moderate, but the potential impact on host selection and access control makes the risk notable.
