Package
elasticsearch-9.5
Component
netty-handler
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
The fix for this vulnerability is available only in netty-handler 4.1.137.Final, which rewrote SslClientHelloHandler.decode(). That rewrite introduced a parsing regression: the newly added aggregatedBytes field offsets reads into the inbound buffer but is never reset, so a ClientHello spanning multiple TLS records leaves the parser misaligned for the remainder of the connection. The package's HTTP server transport extends SslClientHelloHandler to throttle TLS handshakes, so on 4.1.137.Final the service starts and binds its HTTPS port while inbound handshakes stall and never complete. netty 4.1.138.Final ships a byte-identical SslClientHelloHandler and does not address this, so no released version currently carries both the security fix and a working handshake path; remediation is pending a corrected upstream netty release.
Status