{"id":"CVE-2026-75595","summary":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext","details":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","aliases":["GHSA-c4c3-7fpv-j4q5"],"modified":"2026-08-22T09:15:59.299920Z","published":"2026-08-19T21:00:27.627Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-754"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75595.json"},"references":[{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"},{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75595.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595"},{"type":"FIX","url":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"},{"type":"FIX","url":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"},{"type":"FIX","url":"https://github.com/netty/netty/pull/17213"},{"type":"FIX","url":"https://github.com/netty/netty/pull/17217"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/netty/netty","events":[{"introduced":"0"},{"introduced":"09e64d259c99be8b5b2a471a78f11e65eb82598a"},{"fixed":"5471f0a6ffa4ab39db22c468c6c851af4ecae709"},{"fixed":"e0789d32c72f46fd2e7c99b6fdbbf7e2f4409e44"},{"fixed":"1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"},{"fixed":"9e0519239108a69b7e9bbc5e9182ee139a0d7961"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.1.137.Final"},{"introduced":"4.2.0.Final"},{"fixed":"4.2.17.Final"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["netty-4.1.136.Final","netty-4.2.16.Final","netty-4.1.135.Final","netty-4.2.15.Final","netty-4.1.134.Final","netty-4.2.14.Final","netty-4.1.133.Final","netty-4.2.13.Final","netty-4.2.12.Final","netty-4.1.132.Final","netty-4.2.11.Final","netty-4.1.131.Final","netty-4.2.10.Final","netty-4.2.9.Final","netty-4.1.130.Final","netty-4.2.8.Final","netty-4.1.129.Final","netty-4.1.128.Final","netty-4.2.7.Final","netty-4.2.6.Final","netty-4.1.127.Final","netty-4.2.5.Final","netty-4.1.126.Final","netty-4.1.125.Final","netty-4.2.4.Final","netty-4.1.124.Final","netty-4.1.123.Final","netty-4.2.3.Final","netty-4.2.2.Final","netty-4.1.122.Final","netty-4.2.1.Final","netty-4.1.121.Final","netty-4.1.120.Final","netty-4.2.0.Final","netty-4.1.119.Final","netty-4.1.118.Final","netty-4.1.117.Final","netty-4.1.116.Final","netty-4.1.115.Final","netty-4.1.114.Final","netty-4.1.113.Final","netty-4.1.112.Final","netty-4.1.111.Final","netty-4.1.110.Final","netty-4.1.109.Final","netty-4.1.108.Final","netty-4.1.107.Final","netty-4.1.106.Final","netty-4.1.105.Final","netty-4.1.104.Final","netty-4.1.103.Final","netty-4.1.102.Final","netty-4.1.101.Final","netty-4.1.100.Final","netty-4.1.99.Final","netty-4.1.98.Final","netty-4.1.97.Final","netty-4.1.96.Final","netty-4.1.95.Final","netty-4.1.94.Final","netty-4.1.93.Final","netty-4.1.92.Final","netty-4.1.91.Final","netty-4.1.90.Final","netty-4.1.89.Final","netty-4.1.88.Final","netty-4.1.87.Final","netty-4.1.86.Final","netty-4.1.85.Final","netty-4.1.84.Final","netty-4.1.83.Final","netty-4.1.82.Final","netty-4.1.81.Final","netty-4.1.80.Final","netty-4.1.79.Final","netty-4.1.78.Final","netty-4.1.77.Final","netty-4.1.76.Final","netty-4.1.75.Final","netty-4.1.74.Final","netty-4.1.73.Final","netty-4.1.72.Final","netty-4.1.71.Final","netty-4.1.70.Final","netty-4.1.69.Final","netty-4.1.68.Final","netty-4.1.67.Final","netty-4.1.66.Final","netty-4.1.65.Final","netty-4.1.64.Final","netty-4.1.63.Final","netty-4.1.62.Final","netty-4.1.61.Final","netty-4.1.60.Final","netty-4.1.59.Final","netty-4.1.58.Final","netty-4.1.57.Final","netty-4.1.56.Final","netty-4.1.55.Final","netty-4.1.54.Final","netty-4.1.53.Final","netty-4.1.52.Final","netty-4.1.51.Final","netty-4.1.50.Final","netty-4.1.49.Final","netty-4.1.48.Final","netty-4.1.47.Final","netty-4.1.46.Final","netty-4.1.45.Final","netty-4.1.44.Final","netty-4.1.43.Final","netty-4.1.42.Final","netty-4.1.41.Final","netty-4.1.40.Final","netty-4.1.39.Final","netty-4.1.38.Final","netty-4.1.37.Final","netty-4.1.36.Final","netty-4.1.35.Final","netty-4.1.34.Final","netty-4.1.33.Final","netty-4.1.32.Final","netty-4.1.31.Final","netty-4.1.30.Final","netty-4.1.29.Final","netty-4.1.28.Final","netty-4.1.27.Final","netty-4.1.26.Final","netty-4.1.25.Final","netty-4.1.24.Final","netty-4.1.23.Final","netty-4.1.22.Final","netty-4.1.21.Final","netty-4.1.20.Final","netty-4.1.19.Final","netty-4.1.18.Final","netty-4.1.17.Final","netty-4.1.16.Final","netty-4.1.15.Final","netty-4.1.14.Final","netty-4.1.13.Final","netty-4.1.12.Final","netty-4.1.11.Final","netty-4.1.10.Final","netty-4.1.9.Final","netty-4.1.8.Final","netty-4.1.7.Final","netty-4.1.6.Final","netty-4.1.5.Final","netty-4.1.4.Final","netty-4.1.3.Final","netty-4.1.2.Final","netty-4.1.1.Final","netty-4.1.0.Final","netty-4.1.0.CR7","netty-4.1.0.CR6","netty-4.1.0.CR5","netty-4.1.0.CR4","netty-4.1.0.CR3","netty-4.1.0.CR2","netty-4.1.0.CR1","netty-4.1.0.Beta8","netty-4.1.0.Beta7","netty-4.1.0.Beta6","netty-4.1.0.Beta5","netty-4.1.0.Beta4","netty-4.1.0.Beta3","netty-4.1.0.Beta2","netty-4.1.0.Beta1","netty-4.0.15.Final","netty-4.0.14.Final","netty-4.0.14.Beta1","netty-4.0.13.Final","netty-4.0.12.Final","netty-4.0.11.Final","netty-4.0.10.Final","netty-4.0.8.Final","netty-4.0.7.Final","netty-4.0.6.Final","netty-4.0.5.Final","netty-4.0.4.Final","netty-4.0.3.Final","netty-4.0.2.Final","netty-4.0.1.Final","netty-4.0.0.Final","netty-4.0.0.CR9","netty-4.0.0.CR8","netty-4.0.0.CR7","netty-4.0.0.CR5","netty-4.0.0.CR4","netty-4.0.0.CR3","netty-4.0.0.CR2","netty-4.0.0.CR1","netty-4.0.0.Beta3","netty-4.0.0.Beta2","netty-4.0.0.Beta1","netty-4.0.0.Alpha8","netty-4.0.0.Alpha7","netty-4.0.0.Alpha6","netty-4.0.0.Alpha5","netty-4.0.0.Alpha4","netty-4.0.0.Alpha3","netty-4.0.0.Alpha2","netty-4.0.0.Alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75595.json","vanir_signatures_modified":"2026-08-22T09:15:59Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"310329423977751778849009248867086381741","length":354},"id":"CVE-2026-75595-034552bd","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"function":"encodePasswordAuthRequest","file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java"}},{"source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java","function":"isValidClientId"},"deprecated":false,"digest":{"function_hash":"84645625814432201414568833146499814498","length":352},"id":"CVE-2026-75595-09f60da2","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"119615223575837566765244065178035964388","length":128},"id":"CVE-2026-75595-0f43863b","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java","function":"setVaryHeader"}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java"},"deprecated":false,"digest":{"line_hashes":["282584205391126255837647907041050553449","283048779736780770603442295554086408190","100876930371897923814101499104129497743","199008308800094429100050377126780175696"],"threshold":0.9},"id":"CVE-2026-75595-11422529","signature_type":"Line"},{"source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ServerEncoder.java"},"deprecated":false,"digest":{"line_hashes":["111434534492584680139271489916274674933","87038988608188958798333953527582762691","24179610416960414124112729540661031530","101537376295999593172253494069669212656"],"threshold":0.9},"id":"CVE-2026-75595-14514a05","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"266657134240902874145733690197349386320","length":187},"id":"CVE-2026-75595-15186b4c","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java","function":"SctpMessageCompletionHandler"},"deprecated":false},{"deprecated":false,"digest":{"length":2884,"function_hash":"252078690141458402496369299037055254586"},"id":"CVE-2026-75595-21d5f3b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java","function":"decode"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java","function":"encodeCommandRequest"},"deprecated":false,"digest":{"function_hash":"69511370614020679303822040528637381386","length":434},"id":"CVE-2026-75595-3049e874"},{"deprecated":false,"digest":{"line_hashes":["304606498751136794997495334009706469718","107177558362705266919934033521954074373","312612808484785104297145008888539600258","35245758803194600580908711889200407001","238354108155259696271008752013385479962","270300201878344652476721605549785029807","72829825513142438459188254908891036841","47089293698008744633299547383089091190","306517148961537934480361984469492279040","227186552793503249343697377491982533688","95269931787548745384149742689881264668","10558365464053181901721546685170591428","240934830794011705615802792817939437624","331529391539678196836405315176873708507","125291516525870151163642122555791228156","179978483362159425847774058857652721737","699359319783433998045854092820339989","264720037604444257106185515973992752963","95177562195472807523981881539504970212","126574237921925293306150309358777718143","292101331211162847832462712267135774864"],"threshold":0.9},"id":"CVE-2026-75595-30681f6a","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java"}},{"deprecated":false,"digest":{"function_hash":"239763532413240712804373644548443131984","length":1270},"id":"CVE-2026-75595-30766b88","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java","function":"decode"}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"function":"setVaryHeader","file":"codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java"},"deprecated":false,"digest":{"function_hash":"119615223575837566765244065178035964388","length":128},"id":"CVE-2026-75595-34c7bef1","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"function":"encodePasswordAuthRequest","file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java"},"deprecated":false,"digest":{"length":354,"function_hash":"310329423977751778849009248867086381741"},"id":"CVE-2026-75595-368029ba","signature_type":"Function"},{"id":"CVE-2026-75595-3ee221b5","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslClientContext.java"},"deprecated":false,"digest":{"line_hashes":["310036972896424658000476504215627599279","247837072446337809947776431525354726334","295318748867354792658148025094957028217"],"threshold":0.9}},{"digest":{"function_hash":"21155529716826569494050696720247308407","length":804},"id":"CVE-2026-75595-3f4012bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java","function":"testWithFragmentSize"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["331724457763921386641977513232785006130","172377708370951376489260246569647155847","242623739021571001792996631027091703123","125329587813548802613159190159755662911","193595036824952125606223099223961142777","126564958679592127895324433895158756032","144411672403511039102117165178175138846","178878799732441104511424107953485814682","141798731377658361725548792206821260217","6618879759538922833072301215125599244","143591152103464931786285702181395980953","36573729460907588827634826532713221580","155932449538318358231367904734157069015","34360655975431730965834468697874162034","76607776948033405543449478456878011207","7513344509604460836262912540963790669","204441504328591845891819537610474290612","801747241242324390116078164817033814","19004465767594051659031108426210274606","278259369010545182254762585631868019361","241239269185157134251086086798614291768","170347664070434846901702283111846664721","154190756023997702317558097451464763846","47127978030989219552306949879596375409","163834059175750779721337696234264232885","312272159761176127707881467774012950182","144549384150896911193773109012576736907","4849890904199660095622530456320976350","145691052764958929796087637616981731344","308418881326159629552517407561911612040","260811640641953394575012588488395281974","295747577431459138783214723720080232905","72139390797139362971079410964272384261","304354404882646129729428330018948919759","307670452684182456427414009867943974456","242343822151361369861172302821819977186","91549323879308809019744298424093647069","128423189083273786327550237687282668700"],"threshold":0.9},"id":"CVE-2026-75595-3fc542d6","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java"}},{"digest":{"function_hash":"325296808906152172973103469598499065265","length":2358},"id":"CVE-2026-75595-44b07a13","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslClientContext.java","function":"newSessionContext"},"deprecated":false},{"id":"CVE-2026-75595-45b81633","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-socks/src/test/java/io/netty/handler/codec/socksx/v5/Socks5CommonTestUtils.java"},"deprecated":false,"digest":{"line_hashes":["71882725169038574075320211093164928815","64281474823975935739859057432982674088","162919818650513488375178365827790720658","948249899518274885209632945624790742","19263203031032291638556197088393929063"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java","function":"handlerRemoved"},"deprecated":false,"digest":{"function_hash":"47420054499853671149146217798163704091","length":245},"id":"CVE-2026-75595-4662e0e8"},{"deprecated":false,"digest":{"line_hashes":["246184775773600869047566607006738342941","136171328020005735385825093982020434292","48891967717621962076763560062401260279","243017859132947919530460601943796025897","301376082760515948372833318856459321663","38201598405175416409141905396385427317","141010204002241343644454667834876048245","140742950034244572278439772601502659072","285785148084756877732616151217461192572","88789631643813233179874360722602627371","319030582928418178687030118187925984626","236031878516828121964179429653790672960","57720424749599869264481988427967342331","259995779088002293931530194820084828925","178181512481523963468654273763466768919","108738299475697000460271628495870601100","92301227311068822288569505501368903660","187941301241634052401231740311233167414","246304624714192634660090346318182931925","41464477313304192840591094973798237663","80381373364519627035269141630362538537","272649929434106899316283483131261703055","177083057772205109517764026069419634068","193562826616644278913883635477375885874","265971043263109517224159082275974896626","119181800448365908415701241052879092576","1049120356518765182706428402304900414","219808726095123070908957900198783639275","233727041293802880911654219093104111811","144828807669585930495707198366288643917","267564627683821322436641749747299926025","24848216265556955491552320651344407917","256150711748354154213801916522710223309","274244855218759232965673508540246089855","190568197848634380043326987856392746997","7302533453887094791276757211012355361","268912379440728837551193652881280717869","263711980665669032777864889287918493360","78085331452233021172407655898475946489","293652335232826220076493933431870710607","53151260401314179542892604457837072571","114376597745264532894503322265842923091","288850038036615734249552263179224887109","183965643050414617332748854186462607520","299949528583978267534967057093722099746","329014802329217484151557049421139557709","299088250219414814252664064432249298927","174450301500139388402489827936901502108","256676146810446152553892768095790904094","198714208907433092677833060507060183563","91193224863128468158980597132645120424"],"threshold":0.9},"id":"CVE-2026-75595-4689f3ba","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java"}},{"deprecated":false,"digest":{"function_hash":"254265270644632936787834493323205555679","length":2564},"id":"CVE-2026-75595-4acd1eba","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttEncoder.java","function":"encodeConnectMessage"}},{"target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v4/Socks4ClientEncoder.java","function":"encode"},"deprecated":false,"digest":{"function_hash":"48451996250546367794476802560450196851","length":677},"id":"CVE-2026-75595-4beb280b","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"},{"target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v4/Socks4ClientEncoder.java"},"deprecated":false,"digest":{"line_hashes":["316447990029257247595221670681097842755","312212151924432295210877849380211943931","187748292673265952129518986604757154811","58994214456740580087449219923860953908","137788579284630482711658921912385032112","324670778719064382480485295608500654759","7617136440895494601667152917148917672","171948312392197549996143862905538187902","128194272231139109862194393114415838537","300953819359772768659304848127530818552","39908338453173826489828870701538957435","290663670012994515357791039073594884843","336738751569592218709686763008601543117","322742193172742231802749933416471989561","269575617422615032765970598538415526498","327446634071149644449654691163961125854"],"threshold":0.9},"id":"CVE-2026-75595-51f22482","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"},{"deprecated":false,"digest":{"length":1264,"function_hash":"310324125594873364831697137830641997450"},"id":"CVE-2026-75595-520a7278","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java","function":"decode"}},{"deprecated":false,"digest":{"function_hash":"164389366428987331693671801006715638603","length":2203},"id":"CVE-2026-75595-52a5875d","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslClientContext.java","function":"newSessionContext"}},{"source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-mqtt/src/test/java/io/netty/handler/codec/mqtt/MqttCodecTest.java"},"deprecated":false,"digest":{"line_hashes":["246296576765899052738950942814342455847","299788497570909063321551017356741634336","97632577803135676825403676511770862789","271169408272026655953252212964376482632","124662856914275883462376709862196479979","64677745737370849163886569475456758293"],"threshold":0.9},"id":"CVE-2026-75595-55534946","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttDecoder.java","function":"decodeConnectionPayload"},"deprecated":false,"digest":{"function_hash":"297971898401247072601599399019029608369","length":1087},"id":"CVE-2026-75595-57bf02c5"},{"id":"CVE-2026-75595-6a0330cc","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-mqtt/src/test/java/io/netty/handler/codec/mqtt/MqttCodecTest.java"},"deprecated":false,"digest":{"line_hashes":["310269544141687984195740751713274220609","270040917177263885215767135808116317639","97034942581071319035514853955677713434","323431091870731155565195091482331422467","124662856914275883462376709862196479979","64677745737370849163886569475456758293"],"threshold":0.9}},{"source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java"},"deprecated":false,"digest":{"line_hashes":["39595926778102813810809159081120433023","67674864962700762069634164753930034921","286119309229834513103946076990355891025","50136369565418760784050240635116612482","325669794430282543336581901381173080620","269090234934473992797068423756278185846","84545261829192852941369961387552949864","314003180916249909410821640012068733702","5382077240715788499237946883779941464","275141812405827694102489500219929148267","165609481076803256483255538768247532029","70128208561842956062396506912391859835","296041274752186492741171838203213685423","210343461612979617559258036000034794951","255848377540125292127086631663308012220","151181821458566659674376974844598025561","144934634921749047103123824257340834629","124161889003662987538974952695659946954","138602151809220987074637064267633845138","103873090672230280668948326505709694961","259715737563387588197744891088435765655","242662709929262447095431635294093848849","219221404182863036596845597416319342985","250112583936152390373876478858564874110","49785758610807885240685219350646891794","148152989663384925013682870084630822556","304759890619548824976714686916932966003","311800551326773657486799130732346364967","276194915984026117238758430067560437272","326765604686643967988514431849416936977","255774298372383344479635102415452434374","28718057413741911473650255803551728851","167243224264925904281664481856444755453","282020777786190395162392836752681789299","305745943735798820755529316468943342959","28366614083802310832110595266763498924"],"threshold":0.9},"id":"CVE-2026-75595-6b02a4ab","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-75595-6dbe6088","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttEncoder.java"},"deprecated":false,"digest":{"line_hashes":["147141129864921357664580696149815181157","215313122174830754907517210076165162892","317109108086997522641525564659888896019","176236198525261062025975675200562221951","337019637571283019691424531563657687818","291992725190988716997817682276514457119","93928817973236720917951783942522143417","83838478591868831775950194733205864020","16758077589871937865641188146186097788","276224828043099574677149228740945195154","185380752018812209423729576254497477753","122333339594184543075852830371967352210","218247073419626184255698969645432486211","79917951984142327411719643724367587994","330248530384044717973514909925575672615","216239225304600256369183020953018618958","32150687225439002006633803028347016504","185048051314563376548476488915567290044","19063313762585294654716518342234142527","149502762870840764101275969896528099499","24861810437109022353197206183565845648"],"threshold":0.9}},{"source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java","function":"clientHelloInMultipleFragments"},"deprecated":false,"digest":{"function_hash":"230799569796854585791516719095435473308","length":535},"id":"CVE-2026-75595-6f894853","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["10342966798946698587409407711814171166","316982840733350955723891445650037708990","225936985910201744982265163472218884431"],"threshold":0.9},"id":"CVE-2026-75595-72882763","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"transport-sctp/src/test/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandlerTest.java"}},{"source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v4/Socks4ClientEncoder.java","function":"encode"},"deprecated":false,"digest":{"function_hash":"48451996250546367794476802560450196851","length":677},"id":"CVE-2026-75595-730793e6","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"65440548176338237486829628028216355573","length":78},"id":"CVE-2026-75595-7f179796","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java","function":"releaseHandshakeBuffer"}},{"id":"CVE-2026-75595-81c01674","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttEncoder.java","function":"encodeConnectMessage"},"deprecated":false,"digest":{"function_hash":"254265270644632936787834493323205555679","length":2564}},{"target":{"file":"handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java","function":"split"},"deprecated":false,"digest":{"function_hash":"161456110043363489772646159475215361672","length":636},"id":"CVE-2026-75595-83eeac64","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"},{"id":"CVE-2026-75595-8625aac6","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ServerEncoder.java"},"deprecated":false,"digest":{"line_hashes":["111434534492584680139271489916274674933","87038988608188958798333953527582762691","24179610416960414124112729540661031530","101537376295999593172253494069669212656"],"threshold":0.9}},{"digest":{"threshold":0.9,"line_hashes":["331724457763921386641977513232785006130","328062504491528246545553621436083225346","169873721895551159718450093336668480727","107825389270820589157828475113751659000","56980330306962477382648312979819793263","126564958679592127895324433895158756032","144411672403511039102117165178175138846","178878799732441104511424107953485814682","141798731377658361725548792206821260217","6618879759538922833072301215125599244","143591152103464931786285702181395980953","36573729460907588827634826532713221580","155932449538318358231367904734157069015","34360655975431730965834468697874162034","76607776948033405543449478456878011207","153307572811983880941087083956660380126","14458711777400876375215947109858766966","248985900923046071616415693742253410553","146799711745177690487560298738601187225","278259369010545182254762585631868019361","241239269185157134251086086798614291768","170347664070434846901702283111846664721","154190756023997702317558097451464763846","47127978030989219552306949879596375409","163834059175750779721337696234264232885","312272159761176127707881467774012950182","144549384150896911193773109012576736907","4849890904199660095622530456320976350","145691052764958929796087637616981731344","308418881326159629552517407561911612040","260811640641953394575012588488395281974","295747577431459138783214723720080232905","72139390797139362971079410964272384261","304354404882646129729428330018948919759","307670452684182456427414009867943974456","242343822151361369861172302821819977186","91549323879308809019744298424093647069","128423189083273786327550237687282668700"]},"id":"CVE-2026-75595-8867b1c2","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java"},"deprecated":false,"digest":{"line_hashes":["235801353208816727555050469333170019217","197041912008126422274970905081151681126","57284138340904344570345352411954005736","111680178757020153282707049126060905696","255738019306657074338652264361197994723","89973307846025127069170055045421876742","77286247725774255539395707250094811726","230195398580170555126767162495991705941","149127602935779227619829760486773442472","45850024777953181151881568650115809463","185124309345634828045767192654358565241","218722952016958523235005371820829632568","240956277530818201740334239037116141223","240701633980126272723014654877705922377","76305994507845591334263261925276667073","86443636059207854842269731983825353078"],"threshold":0.9},"id":"CVE-2026-75595-88ba608d","signature_type":"Line"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["210517043052950601438940914387460280981","118591466333902493164760031470481948731","158023169324714712007410658600417369277","218183605416868312789978120204031715804","259496706311343930489148368144980008290","107493608204396891282357484067994300984","100826063227314915093477939577346625584"]},"id":"CVE-2026-75595-8b557ffe","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/cors/CorsHandlerTest.java"}},{"target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java","function":"isValidClientId"},"deprecated":false,"digest":{"function_hash":"84645625814432201414568833146499814498","length":352},"id":"CVE-2026-75595-8c65dc7c","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"},{"id":"CVE-2026-75595-9048fd3d","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java","function":"isValidPublishTopicName"},"deprecated":false,"digest":{"function_hash":"98649240771088167076618456790384050886","length":202}},{"deprecated":false,"digest":{"line_hashes":["235801353208816727555050469333170019217","307252540213180357581320991890829750306","87730643393368524281248801166721121984","67071520422612865668937212843155142957","328245283520926205103763874861217083692","73401019909556500277015197106656680002","224851564078659664545031546891176229938","77286247725774255539395707250094811726","230195398580170555126767162495991705941","149127602935779227619829760486773442472","45850024777953181151881568650115809463","185124309345634828045767192654358565241","218722952016958523235005371820829632568","240956277530818201740334239037116141223","240701633980126272723014654877705922377","76305994507845591334263261925276667073","86443636059207854842269731983825353078"],"threshold":0.9},"id":"CVE-2026-75595-99301aa1","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java"}},{"id":"CVE-2026-75595-a0a2655a","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java"},"deprecated":false,"digest":{"line_hashes":["304606498751136794997495334009706469718","107177558362705266919934033521954074373","312612808484785104297145008888539600258","35245758803194600580908711889200407001","238354108155259696271008752013385479962","270300201878344652476721605549785029807","72829825513142438459188254908891036841","47089293698008744633299547383089091190","306517148961537934480361984469492279040","227186552793503249343697377491982533688","264287530538744628627595618037833028860","264720037604444257106185515973992752963","95177562195472807523981881539504970212","126574237921925293306150309358777718143","292101331211162847832462712267135774864"],"threshold":0.9}},{"target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java","function":"encodeCommandRequest"},"deprecated":false,"digest":{"function_hash":"69511370614020679303822040528637381386","length":434},"id":"CVE-2026-75595-a3e2a8b0","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"},{"deprecated":false,"digest":{"function_hash":"329763099192128186628254683565943545886","length":920},"id":"CVE-2026-75595-af357cd2","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"function":"encodePublishMessage","file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttEncoder.java"}},{"source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"handler/src/main/java/io/netty/handler/ssl/ReferenceCountedOpenSslClientContext.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["310036972896424658000476504215627599279","247837072446337809947776431525354726334","295318748867354792658148025094957028217"]},"id":"CVE-2026-75595-b10e69cd","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-75595-b88aa7ca","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java"},"deprecated":false,"digest":{"line_hashes":["282584205391126255837647907041050553449","283048779736780770603442295554086408190","100876930371897923814101499104129497743","199008308800094429100050377126780175696"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttEncoder.java"},"deprecated":false,"digest":{"line_hashes":["147141129864921357664580696149815181157","215313122174830754907517210076165162892","317109108086997522641525564659888896019","109104104056136459873445837776889948839","337019637571283019691424531563657687818","291992725190988716997817682276514457119","93928817973236720917951783942522143417","83838478591868831775950194733205864020","16758077589871937865641188146186097788","276224828043099574677149228740945195154","185380752018812209423729576254497477753","122333339594184543075852830371967352210","218247073419626184255698969645432486211","79917951984142327411719643724367587994","330248530384044717973514909925575672615","216239225304600256369183020953018618958","32150687225439002006633803028347016504","185048051314563376548476488915567290044","19063313762585294654716518342234142527","149502762870840764101275969896528099499","24861810437109022353197206183565845648"],"threshold":0.9},"id":"CVE-2026-75595-ba38bc0c"},{"digest":{"line_hashes":["324808690983077469187000235510024481287","98212123138503418172244104440671059873","46243421001824126733779112587722266493","174620413277139414897908432767910194816","42614853410147991139623189985691524268"],"threshold":0.9},"id":"CVE-2026-75595-bb757e4d","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttDecoder.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/cors/CorsHandlerTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["210517043052950601438940914387460280981","118591466333902493164760031470481948731","158023169324714712007410658600417369277","218183605416868312789978120204031715804","259496706311343930489148368144980008290","107493608204396891282357484067994300984","100826063227314915093477939577346625584"]},"id":"CVE-2026-75595-bf6c74aa"},{"id":"CVE-2026-75595-c388541f","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java"},"deprecated":false,"digest":{"line_hashes":["145049904343987988750562906281679518639","165609481076803256483255538768247532029","70128208561842956062396506912391859835","153596237890617117514334141728639851269","150132177913514258149993909467837485357","141649640522120108752360727801168836742","53812480800437705128987149302751622279","159509013192119284195381204561641795833","144556419091182904851674524720638915458","196820983561557435220055346376359251394","39595926778102813810809159081120433023","67674864962700762069634164753930034921","286119309229834513103946076990355891025","50136369565418760784050240635116612482","49749201897964775611712928174551828817","296041274752186492741171838203213685423","210343461612979617559258036000034794951","255848377540125292127086631663308012220","151181821458566659674376974844598025561","144934634921749047103123824257340834629","124161889003662987538974952695659946954","138602151809220987074637064267633845138","103873090672230280668948326505709694961","259715737563387588197744891088435765655","242662709929262447095431635294093848849","219221404182863036596845597416319342985","250112583936152390373876478858564874110","49785758610807885240685219350646891794","148152989663384925013682870084630822556","304759890619548824976714686916932966003","311800551326773657486799130732346364967","276194915984026117238758430067560437272","326765604686643967988514431849416936977","255774298372383344479635102415452434374","28718057413741911473650255803551728851","167243224264925904281664481856444755453","282020777786190395162392836752681789299","305745943735798820755529316468943342959","28366614083802310832110595266763498924"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java","function":"decode"},"deprecated":false,"digest":{"function_hash":"252078690141458402496369299037055254586","length":2884},"id":"CVE-2026-75595-c529a4fc"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java","function":"encodeAuthMethodRequest"},"deprecated":false,"digest":{"function_hash":"192590091037164635888477825873356956852","length":454},"id":"CVE-2026-75595-c68aea57","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"141762756347891087771076149577825706643","length":140},"id":"CVE-2026-75595-cabc8751","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttCodecUtil.java","function":"isValidPublishTopicName"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java","function":"testWithFragmentSize"},"deprecated":false,"digest":{"function_hash":"21155529716826569494050696720247308407","length":804},"id":"CVE-2026-75595-cb3c1410"},{"digest":{"function_hash":"47420054499853671149146217798163704091","length":245},"id":"CVE-2026-75595-d0373c6a","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java","function":"handlerRemoved"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["316447990029257247595221670681097842755","312212151924432295210877849380211943931","187748292673265952129518986604757154811","58994214456740580087449219923860953908","137788579284630482711658921912385032112","324670778719064382480485295608500654759","7617136440895494601667152917148917672","171948312392197549996143862905538187902","128194272231139109862194393114415838537","300953819359772768659304848127530818552","39908338453173826489828870701538957435","290663670012994515357791039073594884843","336738751569592218709686763008601543117","322742193172742231802749933416471989561","269575617422615032765970598538415526498","327446634071149644449654691163961125854"],"threshold":0.9},"id":"CVE-2026-75595-d3c549d6","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v4/Socks4ClientEncoder.java"}},{"digest":{"function_hash":"266657134240902874145733690197349386320","length":187},"id":"CVE-2026-75595-d598f0d6","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"transport-sctp/src/main/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandler.java","function":"SctpMessageCompletionHandler"},"deprecated":false},{"source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"function":"encodeCommandResponse","file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ServerEncoder.java"},"deprecated":false,"digest":{"function_hash":"69511370614020679303822040528637381386","length":434},"id":"CVE-2026-75595-d9518656","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttEncoder.java","function":"encodePublishMessage"},"deprecated":false,"digest":{"function_hash":"317486826123308198253895771660910329816","length":936},"id":"CVE-2026-75595-db1c1393","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java","function":"encodeAuthMethodRequest"},"deprecated":false,"digest":{"function_hash":"192590091037164635888477825873356956852","length":454},"id":"CVE-2026-75595-dc0c2126","signature_type":"Function"},{"id":"CVE-2026-75595-dfdf92e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java","function":"releaseHandshakeBuffer"},"deprecated":false,"digest":{"function_hash":"65440548176338237486829628028216355573","length":78}},{"deprecated":false,"digest":{"line_hashes":["246184775773600869047566607006738342941","136171328020005735385825093982020434292","48891967717621962076763560062401260279","243017859132947919530460601943796025897","301376082760515948372833318856459321663","38201598405175416409141905396385427317","141010204002241343644454667834876048245","140742950034244572278439772601502659072","285785148084756877732616151217461192572","88789631643813233179874360722602627371","319030582928418178687030118187925984626","236031878516828121964179429653790672960","57720424749599869264481988427967342331","259995779088002293931530194820084828925","178181512481523963468654273763466768919","108738299475697000460271628495870601100","92301227311068822288569505501368903660","187941301241634052401231740311233167414","246304624714192634660090346318182931925","41464477313304192840591094973798237663","80381373364519627035269141630362538537","272649929434106899316283483131261703055","177083057772205109517764026069419634068","193562826616644278913883635477375885874","265971043263109517224159082275974896626","119181800448365908415701241052879092576","1049120356518765182706428402304900414","219808726095123070908957900198783639275","233727041293802880911654219093104111811","144828807669585930495707198366288643917","267564627683821322436641749747299926025","24848216265556955491552320651344407917","256150711748354154213801916522710223309","274244855218759232965673508540246089855","190568197848634380043326987856392746997","7302533453887094791276757211012355361","268912379440728837551193652881280717869","263711980665669032777864889287918493360","78085331452233021172407655898475946489","293652335232826220076493933431870710607","53151260401314179542892604457837072571","114376597745264532894503322265842923091","288850038036615734249552263179224887109","183965643050414617332748854186462607520","299949528583978267534967057093722099746","329014802329217484151557049421139557709","299088250219414814252664064432249298927","174450301500139388402489827936901502108","256676146810446152553892768095790904094","198714208907433092677833060507060183563","91193224863128468158980597132645120424"],"threshold":0.9},"id":"CVE-2026-75595-e0cb93da","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java"}},{"id":"CVE-2026-75595-e1a5098f","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ClientEncoder.java","function":"encodePrivateAuthRequest"},"deprecated":false,"digest":{"function_hash":"47569753458370203708918479513628561223","length":174}},{"deprecated":false,"digest":{"function_hash":"297971898401247072601599399019029608369","length":1087},"id":"CVE-2026-75595-e1d5b9a8","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttDecoder.java","function":"decodeConnectionPayload"}},{"source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java","function":"split"},"deprecated":false,"digest":{"function_hash":"161456110043363489772646159475215361672","length":636},"id":"CVE-2026-75595-e6bd2796","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"69511370614020679303822040528637381386","length":434},"id":"CVE-2026-75595-e8ca324b","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","target":{"file":"codec-socks/src/main/java/io/netty/handler/codec/socksx/v5/Socks5ServerEncoder.java","function":"encodeCommandResponse"}},{"digest":{"line_hashes":["10342966798946698587409407711814171166","316982840733350955723891445650037708990","225936985910201744982265163472218884431"],"threshold":0.9},"id":"CVE-2026-75595-f9755368","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"transport-sctp/src/test/java/io/netty/handler/codec/sctp/SctpMessageCompletionHandlerTest.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"230799569796854585791516719095435473308","length":535},"id":"CVE-2026-75595-fb31f59a","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"handler/src/test/java/io/netty/handler/ssl/SniHandlerTest.java","function":"clientHelloInMultipleFragments"}},{"id":"CVE-2026-75595-fefeabdc","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","target":{"file":"codec-mqtt/src/main/java/io/netty/handler/codec/mqtt/MqttDecoder.java"},"deprecated":false,"digest":{"line_hashes":["324808690983077469187000235510024481287","98212123138503418172244104440671059873","46243421001824126733779112587722266493","174620413277139414897908432767910194816","42614853410147991139623189985691524268"],"threshold":0.9}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}