--- title: "CVE-2026-75596\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2026-75596?format=md keywords: index, follow --- # CVE-2026-75596 Publication date 19 August 2026 Last updated 2 September 2026 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | netty | 26.04 LTS resolute | Needs evaluation | | 24.04 LTS noble | Needs evaluation | | 22.04 LTS jammy | Needs evaluation | | 20.04 LTS focal | Needs evaluation | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Needs evaluation | | 14.04 LTS trusty | Needs evaluation | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Severity score breakdown CVSS version: CVSS v4.0 **Base score** 8.7 · High * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Attack requirements | None | | Privileges required | None | | User interaction | None | | Vulnerable system - Confidentiality impact | None | | Vulnerable system - Integrity impact | None | | Vulnerable system - Availability impact | High | | Subsequent system - Confidentiality impact | None | | Subsequent system - Integrity impact | None | | Subsequent system - Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 8.7 · High | | Base + Threat score | - | | Base + Environmental score | - | | Base + Threat + Environmental score | - | **Vector:** CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75596) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-75596) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-75596) * [Debian](https://security-tracker.debian.org/tracker/CVE-2026-75596) ### Other references * * * * * * * *