Netty, an asynchronous network framework, could allow an unauthenticated remote peer to send a fragmented ClientHello. By delivering the handshake body in thousands of tiny records, the library spends quadratic time in its pre-handshake reassembly routine, which recopies all previously received bytes for each new record. This flaw, classified as CWE‑407, can overwhelm the event loop’s CPU, degrading TLS processing for legitimate users and potentially refusing service altogether.

The vulnerability affects Netty versions earlier than 4.1.137.Final and 4.2.17.Final. Any application that includes an unpatched Netty library and relies on the default SniHandler constructor is exposed. Based on typical use scenarios for Netty, applications such as web servers and microservice frameworks that use Netty for TLS handling are likely affected.

With a CVSS score of 8.7, the risk is considered high; the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The attack does not require any authentication and can be initiated by an external peer that initiates a TLS handshake. The attacker can craft a handshake split into many small fragments to trigger the quadratic processing cost, which is a classical denial‑of‑service attack path.