Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Netty handler component can be exploited – patch now

CVE-2026-75595 · published 5 days ago
Summary

The Netty handler library used in Java applications contained a security weakness that could let an attacker take control or disrupt the service. This affects any software that includes io.netty:netty-handler or the Netty packages from Debian, Canonical, or Root. Install the latest patched version of the Netty handler library as soon as possible to eliminate the risk.

What to do
  • Update io.netty:netty-handler to version 4.2.17.Final.
  • Update io.netty:netty-handler to version 4.1.137.Final.
  • Update io.netty:netty-handler to version 4.1.119.Final-aikido.9.
  • Update io.root.io.netty:netty-handler to version 4.1.119.Final-root.io.9.
  • Update io.netty:netty-handler to version 4.1.135.Final-aikido.1.
  • Update io.root.io.netty:netty-handler to version 4.1.135.Final-root.io.1.
  • Update io.netty:netty-handler to version 4.1.118.Final-aikido.26.
  • Update io.root.io.netty:netty-handler to version 4.1.118.Final-root.io.26.
  • Update io.netty:netty-handler to version 4.1.119.Final-aikido.10.
  • Update io.root.io.netty:netty-handler to version 4.1.119.Final-root.io.10.
  • Update io.netty:netty-handler to version 4.1.136.Final-aikido.1.
  • Update io.root.io.netty:netty-handler to version 4.1.136.Final-root.io.1.
  • Update io.netty:netty-handler to version 4.2.16.Final-aikido.1.
  • Update io.root.io.netty:netty-handler to version 4.2.16.Final-root.io.1.
Affected software
Ecosystem VendorProductAffected versions
maven – io.netty:netty-handler >= 4.2.0.Final, <= 4.2.16.Final
<= 4.1.136.Final
Fix: upgrade to 4.2.17.Final
– netty netty < 4.1.137.Final
< 4.1.137
>= 4.2.0, < 4.2.17
Debian:11 debian netty All versions
Debian:12 debian netty All versions
Debian:13 debian netty All versions
Debian:14 debian netty All versions
Root:Maven – io.netty:netty-handler < 4.1.119.Final-aikido.9
< 4.1.135.Final-aikido.1
< 4.1.118.Final-aikido.26
< 4.1.119.Final-aikido.10
< 4.1.136.Final-aikido.1
< 4.2.16.Final-aikido.1
Fix: upgrade to 4.1.119.Final-aikido.9
Root:Maven – io.root.io.netty:netty-handler < 4.1.119.Final-root.io.9
< 4.1.135.Final-root.io.1
< 4.1.118.Final-root.io.26
< 4.1.119.Final-root.io.10
< 4.1.136.Final-root.io.1
< 4.2.16.Final-root.io.1
Fix: upgrade to 4.1.119.Final-root.io.9
Ubuntu:Pro:14.04:LTS canonical netty All versions
Original advisory text
CVE-2026-75595 in io.netty:netty-handler - Patched by Root
Root has patched CVE-2026-75595 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-754Improper Check for Unusual or Exceptional Conditions
CWE-475Undefined Behavior for Input to API
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen19 Aug 2026
Sources
GHSA-c4c3-7fpv-j4q5 · GHSA
CVE-2026-75595 · OSV
DEBIAN-CVE-2026-75595 · OSV
CVE-2026-75595 · NVD
CVE-2026-75595 · MITRE
UBUNTU-CVE-2026-75595 · OSV
ROOT-APP-MAVEN-CVE-2026-75595 · OSV
Track software like this
Free during beta