CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

High 8.2 Published 26 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116541?

CVE-2026-116541 is a high-severity vulnerability in netty-tcnative, published on 26 Oct 2026.

Official description

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

Weakness: CWE-682

Which versions are affected by CVE-2026-116541?

How do I fix CVE-2026-116541?

No fix has been published for CVE-2026-116541 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116541 being exploited?

There is no known exploitation of CVE-2026-116541 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-116541, GHSA-9xr3-jwv4-r489, GHSA-rm79-885g-92ch, UBUNTU-CVE-2026-116541.