Technical Analysis: Netty CVE-2026-75595, Next.js CVE-2026-75604, GHSA-2xp9-vwfh-vxw4 & GitPython CVE-2026-78676

In this blog we’re breaking down each CVE separately, including the root cause, technical overview and patch details.

Read our analysis of these 4 critical CVEs

Root Cause

A TLS record begins with a 5-byte header, and the handshake message inside it begins with its own 4-byte header: one byte of handshake type, three bytes of length. `SslClientHelloHandler` has to read both before it knows how much ClientHello to expect, and the standard permits a handshake message to be split across several records, so it must be prepared for the header to arrive incomplete.…