CLSA-2026-1787309634 TuxCare security update for io.netty (60 CVEs)

🗓️ 21 Aug 2026 10:53:54Reported by GoogleType

osv🔗 osv.dev👁 9 Views

TuxCare security update for io.netty 4.1.111.Final-tuxcare.1 addressing 60 CVEs.

Reporter	Title	Published	Views	Family All 6080
Vulnrichment	CVE-2026-50020 Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted	12 Jun 202614:55	–	vulnrichment
Vulnrichment	CVE-2026-50560 Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature	12 Jun 202614:59	–	vulnrichment
Vulnrichment	CVE-2026-55831 Netty SPDY SETTINGS frame count materializes unbounded settings map	20 Jul 202623:00	–	vulnrichment
Vulnrichment	CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation	20 Jul 202623:18	–	vulnrichment
Vulnrichment	CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion	21 Jul 202621:22	–	vulnrichment
Vulnrichment	CVE-2026-56746 Netty has a Security Control Bypass via CORS Short-Circuit Failure	21 Jul 202621:36	–	vulnrichment
Vulnrichment	CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled	21 Jul 202622:06	–	vulnrichment
Vulnrichment	CVE-2026-56818 Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state	7 Aug 202617:14	–	vulnrichment
Vulnrichment	CVE-2026-56819 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)	21 Jul 202622:11	–	vulnrichment
Vulnrichment	CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks	21 Jul 202622:26	–	vulnrichment

21 Aug 2026 12:45Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.18.7 - 10

CVSS 48.7

EPSS0.02149

SSVC

io.netty security update TuxCare multiple CVEs library