Hi,

The following vulnerabilities were published for netty-tcnative.

CVE-2026-116539[0]:
| Netty netty-tcnative before 2.0.84.Final contains a heap buffer
| overflow vulnerability in the tcn_write_to_bytebuffer BIO callback
| caused by failing to wrap the non-application ring buffer write
| index. Remote TLS peers can drive handshake, renegotiation, or post-
| handshake messages into this buffer, triggering an out-of-bounds
| memcpy that crashes the JVM process.


CVE-2026-116540[1]:
| netty-tcnative 2.0.66.Final before 2.0.84.Final built against
| OpenSSL 3.x contains a use-after-free vulnerability in
| ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote
| clients performing TLS handshakes while setSessionTicketKeys0 frees
| the shared key array cause OpenSSL to read freed HMAC keys, crashing
| or corrupting ticket processing.


CVE-2026-116541[2]:
| Netty netty-tcnative before 2.0.84.Final contains a denial of
| service vulnerability in the tcn_write_to_bytebuffer BIO write
| callback that overreports bytes consumed. Remote TLS 1.3 peers can
| provoke queued post-handshake records like NewSessionTicket or
| KeyUpdate to truncate flights, fail connections, or abort the JVM
| process.


CVE-2026-116542[3]:
| Netty netty-tcnative before 2.0.84.Final contains an SNI hostname
| spoofing vulnerability that allows remote unauthenticated clients to
| alter hostnames via JNI NewStringUTF decoding. Attackers can send
| overlong encodings like 0xC0 0x80 in the ClientHello server_name to
| confuse SNI-based certificate selection, access decisions, and
| logging.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-116539
https://www.cve.org/CVERecord?id=CVE-2026-116539
[1] https://security-tracker.debian.org/tracker/CVE-2026-116540
https://www.cve.org/CVERecord?id=CVE-2026-116540
[2] https://security-tracker.debian.org/tracker/CVE-2026-116541
https://www.cve.org/CVERecord?id=CVE-2026-116541
[3] https://security-tracker.debian.org/tracker/CVE-2026-116542
https://www.cve.org/CVERecord?id=CVE-2026-116542

Regards,
Salvatore