Netty SNI Handler Quadratic CPU Exhaustion DoS (CWE-407)

Vulnerability Overview Vulnerability Name: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing Vulnerability Description: Netty’s default SNI endpoint reassembles and recovers previously received TLS handshake fragments. Each additional TLS handshake record causes a large ClientHello length to be declared, after which the body is split into many small records, leading to super-linear (quadratic) CPU work. In the case of 4,095 single-byte fragments, the processor reassembles 8,386,560 bytes, while only 24,579 bytes were present on the network. This represents a 341x amplification ratio. Affected Scope Affected Versions: - Affected versions: - Patched version: - Affected versions: - Patched version: Affected Endpoints: — default constructor — pre-handshake ClientHello aggregation path Vulnerable Code Locations: (decode entry) (handshakeBuffer.clear) (writeBytes re-copy) (cumulation retention) Remediation Patched Versions: - Patched version: - Patched version: POC Code Impact Vulnerability Type: CWE-407 — Inefficient Algorithmic Complexity Unauthenticated remote attackers can drive excessive CPU consumption in the Netty event loop Affects all Netty deployments using SniHandler for TLS termination (default SNI path) Requires no privileges, user interaction, or special configuration Can degrade or halt TLS connection processing, impacting all clients The attack requires modest bandwidth (<25 KB) to trigger significant CPU work Credits Liy Dau: https://github.com/1110-github Ziyue Wang: https://github.com/zyy990 Sinick: https://github.com/sinickland Maurice: https://maurice-busystar.org/ Chenchen Yu: https://github.com/chenchen-yu

Goal Reached Thanks to every supporter — we hit 100%!

Netty SNI Handler Quadratic CPU Exhaustion DoS (CWE-407)

More from this source