[
https://issues.apache.org/jira/browse/CASSANDRA-21695?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116591#comment-18116591
]
Kapil Shewate commented on CASSANDRA-21695:
-------------------------------------------
CVEID: CVE-2026-75595
Description: Netty is an asynchronous, event-driven network application
framework. Prior to 4.1.137.Fina and 4.2.17.Final,
io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset
before reading the four-byte TLS handshake header, so a ClientHello whose
handshake header spans records can cause an IndexOutOfBoundsException and
invoke select(ctx, null). This selects the default SslContext instead of the
SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the
sole mutual TLS gate, the default SslContext uses clientAuth=NONE or
clientAuth=OPTIONAL, and no application-layer certificate verification exists,
an unauthenticated remote attacker can bypass the protected route's mutual TLS
requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
CVSS Source: [email protected]
CVSS Base Score: 9.1
CVSS Vector:
(CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVEID: CVE-2026-75596
Description: Netty is an asynchronous, event-driven network application
framework. Prior to 4.1.137.Final and 4.2.17.Final, the default
io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello
aggregation path in
handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at
io.netty.handler.ssl.SslClientHelloHandler#decode, where
handshakeBuffer.clear() and writeBytes() recopy all previously received body
bytes for every additional TLS record. An unauthenticated remote peer can
advertise a large ClientHello and deliver its body in thousands of tiny
records, causing quadratic CPU work on the event loop before the TLS handshake
completes and degrading TLS handling for other clients. This issue is fixed in
versions 4.1.137.Final and 4.2.17.Final.
CWE: CWE-407: Inefficient Algorithmic Complexity
CVSS Source: [email protected]
CVSS Base Score: 8.7
> CVE-2026-75595.Netty is an asynchronous, event-driven network application
> framework. Prior to 4.1.137.Fina and 4.2.17.Final,
> io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset
> before reading the four-byte TLS handshake header
> --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-21695
> URL: https://issues.apache.org/jira/browse/CASSANDRA-21695
> Project: Apache Cassandra
> Issue Type: Bug
> Reporter: Kapil Shewate
> Priority: Urgent
>
> Netty is an asynchronous, event-driven network application framework. Prior
> to 4.1.137.Fina and 4.2.17.Final,
> io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset
> before reading the four-byte TLS handshake header, so a ClientHello whose
> handshake header spans records can cause an IndexOutOfBoundsException and
> invoke select(ctx, null). This selects the default SslContext instead of the
> SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the
> sole mutual TLS gate, the default SslContext uses clientAuth=NONE or
> clientAuth=OPTIONAL, and no application-layer certificate verification
> exists, an unauthenticated remote attacker can bypass the protected route's
> mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and
> 4.2.17.Final.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
