Algorithmic Complexity Affecting trino-plugin-kafka-event-listener package, versions <482-r0
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-MINIMOSLATEST-TRINOPLUGINKAFKAEVENTLISTENER-19665534
- published10 Sept 2026
- disclosed19 Aug 2026
Introduced: 19 Aug 2026
NewCVE-2026-75596 (opens in a new tab)How to fix?
Upgrade Minimos:latest trino-plugin-kafka-event-listener to version 482-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream trino-plugin-kafka-event-listener package and not the trino-plugin-kafka-event-listener package as distributed by Minimos.
See How to fix? for Minimos:latest relevant fixed versions and status.
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
References
- https://www.cve.org/CVERecord?id=CVE-2026-75596
- https://github.com/advisories/GHSA-fccg-mwvh-qqg4
- https://osv.dev/vulnerability/MINI-jghg-3465-fpvr
- https://osv.dev/vulnerability/CVE-2026-75596
- https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7
- https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961
- https://github.com/netty/netty/pull/17213
- https://github.com/netty/netty/pull/17217
- https://github.com/netty/netty/releases/tag/netty-4.1.137.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.17.Final
- https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4