Netty SniHandler quadratic-complexity DoS via fragmented ClientHello reassembly

#!/usr/bin/env bash
# check_cve_2026_75596.sh — Detect netty-handler versions vulnerable to CVE-2026-75596
# Usage: bash check_cve_2026_75596.sh <search_directory>
# Exit codes: 0 = PATCHED/not found, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

SEARCH_DIR="${1:-.}"
VULNERABLE=0
FOUND=0

echo "[*] Scanning for netty-handler JARs under: $SEARCH_DIR"

while IFS= read -r -d '' jar; do
  FOUND=1
  filename=$(basename "$jar")
  # Extract version from filename like netty-handler-4.1.136.Final.jar
  if [[ "$filename" =~ netty-handler-([0-9]+)\.([0-9]+)\.([0-9]+) ]]; then
    major="${BASH_REMATCH[1]}"
    minor="${BASH_REMATCH[2]}"
    patch="${BASH_REMATCH[3]}"
    version="$major.$minor.$patch"
    
    is_vuln=0
    if [[ "$major" -eq 4 && "$minor" -eq 1 ]]; then
      # 4.1.x: vulnerable if patch < 137
      if [[ "$patch" -lt 137 ]]; then
        is_vuln=1
      fi
    elif [[ "$major" -eq 4 && "$minor" -eq 2 ]]; then
      # 4.2.x: vulnerable if patch < 17
      if [[ "$patch" -lt 17 ]]; then
        is_vuln=1
      fi
    elif [[ "$major" -lt 4 ]]; then
      is_vuln=1
    elif [[ "$major" -eq 4 && "$minor" -lt 1 ]]; then
      is_vuln=1
    fi
    
    if [[ "$is_vuln" -eq 1 ]]; then
      echo "VULNERABLE — $jar (version $version)"
      VULNERABLE=1
    else
      echo "PATCHED   — $jar (version $version)"
    fi
  else
    # Try reading version from META-INF inside JAR
    if command -v unzip &>/dev/null; then
      manifest_ver=$(unzip -p "$jar" META-INF/MANIFEST.MF 2>/dev/null | grep -i 'Bundle-Version\|Implementation-Version' | head -1 | awk -F': ' '{print $2}' | tr -d '\r' || true)
      if [[ -n "$manifest_ver" ]]; then
        echo "UNKNOWN   — $jar (manifest version: $manifest_ver — verify manually)"
      else
        echo "UNKNOWN   — $jar (could not determine version)"
      fi
    else
      echo "UNKNOWN   — $jar (could not determine version; install unzip for manifest check)"
    fi
  fi
done < <(find "$SEARCH_DIR" -type f -name 'netty-handler-*.jar' -print0 2>/dev/null)

# Also check for shaded/uber JARs containing netty handler
while IFS= read -r -d '' jar; do
  if command -v unzip &>/dev/null; then
    if unzip -l "$jar" 2>/dev/null | grep -q 'io/netty/handler/ssl/SniHandler'; then
      FOUND=1
      echo "WARNING   — $jar contains shaded netty SniHandler — check version manually"
    fi
  fi
done < <(find "$SEARCH_DIR" -type f -name '*.jar' ! -name 'netty-handler-*' -print0 2>/dev/null)

if [[ "$FOUND" -eq 0 ]]; then
  echo "PATCHED — No netty-handler JARs found under $SEARCH_DIR"
  exit 0
elif [[ "$VULNERABLE" -eq 1 ]]; then
  exit 1
else
  exit 0
fi