CVE-2026-45416: Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Synopsis

This is a memory exhaustion vulnerability in the Netty network framework, specifically in its SNI (Server Name Indication) TLS handshake handler. The flaw is reachable over the network with no authentication required, and exploiting it causes the server to immediately allocate up to 16 MiB of heap memory per connection by sending just nine crafted bytes in a TLS ClientHello message. Successful exploitation allows a remote attacker to exhaust JVM heap memory and crash or severely degrade the affected service. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment fix versions are published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the TLS listener over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  The malicious ClientHello can be sent before any authentication takes place, so no credentials or session token are needed.

• Victim interactionNot required

  No user action is required; the server processes the crafted TLS record automatically upon receipt.

• Attack complexityDetail

  Exploitation is reliable and condition-free: sending a nine-byte ClientHello with a crafted 24-bit handshake length field is sufficient to trigger the oversized allocation on any unpatched endpoint using the default SniHandler constructors.

Blast Radius

• The attacker forces an immediate 16 MiB unpooled heap allocation per connection, retained until the channel closes.
• Repeated connections exhaust JVM heap memory, causing out-of-memory errors and crashing the Netty-based service.
• All traffic handled by the affected server process is disrupted, including legitimate TLS connections from real clients.
• Depending on deployment topology, a crash of the Netty process can take down co-located services or trigger cascading failures in dependent systems.