CVE-2026-75596 exposes a quadratic buffer-allocation vulnerability in Netty's SslClientHelloHandler that exploits the TLS handshake itself—before any authentication occurs. The attack is elementary: send a ClientHello fragmented across thousands of tiny TLS records. Each record triggers a buffer copy that resizes the accumulation buffer, and the aggregate work grows quadratically with the number of fragments. On the event loop, this means a single malicious client can starve all other connections.
The critical problem is that this vulnerability isn't in an edge case—it's in the default constructor path. Netty's SniHandler, used widely as the entry point for TLS SNI processing, instantiates SslClientHelloHandler without explicit configuration, which means every deployment that followed standard patterns is exposed. The quadratic buffer copy happens before TLS negotiation completes, so authentication provides no defense. One hostile client per event loop is sufficient to degrade service for every connected user.
The fix in 4.1.137.Final and 4.2.17 adds bounds checking to constrain the aggregation, but understand what this does and doesn't change. The underlying algorithm likely still performs quadratic work—it now fails closed at a size threshold rather than scaling transparently. This is a security fix, not an architectural correction. Review your configuration for any handlerBufferSize or maxClientHelloSize parameters introduced by the patch, and understand what happens when those bounds are hit—connection rejection is the intended behavior, but verify your alerting captures it.
What matters practically: if you're on any Netty version before 4.1.137 or 4.2.17 and accept TLS connections, you're vulnerable. The exposure is trivial to test—send a fragmented ClientHello and observe event-loop CPU spikes. The real risk isn't sophisticated exploitation; it's that this is a resource exhaustion vector available to anyone with a network socket. Update immediately, then audit other Ssl*Handler instances in your dependency tree for similar aggregation patterns—this is the third library in a decade to expose quadratic behavior in trust-boundary parsing, and the pattern will recur.