CVE-2026-116539 Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-116539?
CVE-2026-116539 is a high-severity vulnerability in netty-tcnative, published on 26 Oct 2026.
Official description
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.
Weakness: CWE-787
Which versions are affected by CVE-2026-116539?
How do I fix CVE-2026-116539?
No fix has been published for CVE-2026-116539 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-116539 being exploited?
There is no known exploitation of CVE-2026-116539 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116539, GHSA-22qq-f4wc-4vfx, GHSA-gf9q-9mg7-g5qh, UBUNTU-CVE-2026-116539.