CVE-2026-116542

The record

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

Affected packages

Related vulnerabilities

• CVE-2026-62374 SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT)… CWE-176
• CVE-2026-114114 Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based… CWE-176
• CVE-2026-110687 Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during… CWE-176
• CVE-2026-110674 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare… CWE-176
• CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by… CWE-176
• CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
• CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176
• CVE-2026-14978 HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass… CWE-176