{
  "id": 17435597,
  "title": "Downstream Netty Advisories Around CVE-2026-75595",
  "url": "https://urgent.news/2026/10/31/downstream-netty-advisories-around-cve-2026-75595",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-31T17:04:04.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/jeffreyciend/downstream-netty-advisories-around-cve-2026-75595-3647"
  },
  "original_language": "en",
  "account": null,
  "summary": "The CVE-2026-75595 vulnerability affects the Netty library in various Java products, with vulnerable versions ranging from 4.1.136.Final to 4.2.16.Final. The issue arises when a fragmented TLS ClientHello causes the parser to use a default SslContext after an exception, potentially leading to a man-in-the-middle (MITM) bypass in certain deployments. To mitigate the vulnerability, Netty released patched versions 4.1.137.Final and 4.2.17.Final, which address the issue by aggregating record payloads until the four-byte handshake header is complete. However, downstream vendors have varying update paths for the Netty library, and it is crucial for organizations to verify the fixed build, packaged Netty version, and TLS policy in the deployed service. Additionally, organizations should obtain the Software Bill of Materials (SBOM), package manifest, or build information for the supported release and ask for details about the embedded component and affected TLS path if the product is a managed service. Self-managed deployments should collect the product patch identifier, vendor's fixed-release statement, local build revision, and resolved netty-handler version.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}