A flaw in netty-tcnative allows a remote, unauthenticated client to supply an overlong, modified UTF‑8 SNI hostname inside the TLS ClientHello. The JNI NewStringUTF decoding misinterprets sequences such as 0xC0 0x80, causing the server to use a different hostname for certificate selection, access control, and logging. Attackers can therefore obtain data from certificates not intended for the target host or bypass host‑based access checks, resulting in potential confidentiality and integrity exposure.

Netty netty‑tcnative and netty‑tcnative‑boringssl‑static before version 2.0.84.Final are affected. All releases earlier than 2.0.84.Final should be considered vulnerable until the library is upgraded.

The vulnerability scores a mid‑to‑high CVSS of 6.9; its EPSS score is unavailable and it is not listed in CISA’s KEV catalogue. Because the attack can be performed by any remote client sending a crafted TLS ClientHello, the exploitability is moderate to high. Attackers can remotely alter hostname resolution without authentication, potentially gaining data disclosure or bypassing host‑based controls.