io.netty:netty-tcnative-boringssl-static 2.0.75.Final

Direct Vulnerabilities

Known vulnerabilities in the io.netty:netty-tcnative-boringssl-static package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Incorrect Calculation Affected versions of this package are vulnerable to Incorrect Calculation via the `tcn_write_to_bytebuffer` callback in the BIO write process. An attacker can cause queued post-handshake records to truncate flights, fail connections, or abort the JVM process by sending specially crafted TLS 1.3 messages. How to fix Incorrect Calculation? Upgrade `io.netty:netty-tcnative-boringssl-static` to version 2.0.84.Final or higher.	[,2.0.84.Final)
C Out-of-bounds Write Affected versions of this package are vulnerable to Out-of-bounds Write via the `tcn_write_to_bytebuffer` BIO callback process. An attacker can cause the JVM process to crash by sending specially crafted handshake, renegotiation, or post-handshake messages that trigger an out-of-bounds memory copy operation. How to fix Out-of-bounds Write? Upgrade `io.netty:netty-tcnative-boringssl-static` to version 2.0.84.Final or higher.	[,2.0.84.Final)
M Improper Handling of Unicode Encoding Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding via the `NewStringUTF` decoding process. An attacker can bypass host-based access controls and influence certificate selection or logging by sending specially crafted overlong UTF-8 encodings in the `server_name` field of the ClientHello message. How to fix Improper Handling of Unicode Encoding? Upgrade `io.netty:netty-tcnative-boringssl-static` to version 2.0.84.Final or higher.	[,2.0.84.Final)

Vulnerability

Vulnerable Version

Incorrect Calculation

Affected versions of this package are vulnerable to Incorrect Calculation via the tcn_write_to_bytebuffer callback in the BIO write process. An attacker can cause queued post-handshake records to truncate flights, fail connections, or abort the JVM process by sending specially crafted TLS 1.3 messages.

How to fix Incorrect Calculation?

Upgrade io.netty:netty-tcnative-boringssl-static to version 2.0.84.Final or higher.

[,2.0.84.Final)

Out-of-bounds Write

Affected versions of this package are vulnerable to Out-of-bounds Write via the tcn_write_to_bytebuffer BIO callback process. An attacker can cause the JVM process to crash by sending specially crafted handshake, renegotiation, or post-handshake messages that trigger an out-of-bounds memory copy operation.

How to fix Out-of-bounds Write?

Upgrade io.netty:netty-tcnative-boringssl-static to version 2.0.84.Final or higher.

[,2.0.84.Final)

Improper Handling of Unicode Encoding

Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding via the NewStringUTF decoding process. An attacker can bypass host-based access controls and influence certificate selection or logging by sending specially crafted overlong UTF-8 encodings in the server_name field of the ClientHello message.

How to fix Improper Handling of Unicode Encoding?

Upgrade io.netty:netty-tcnative-boringssl-static to version 2.0.84.Final or higher.

[,2.0.84.Final)

io.netty:netty-tcnative-boringssl-static@2.0.75.Final

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically