netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake

🗓️ 06 Oct 2026 11:45:00Reported by RedHatType

redhat🔗 access.redhat.com👁 8 Views

Remote DoS in Netty due to eager memory buffer allocation during TLS handshake.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in DataView	2 Jul 202616:17	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Netty IBM webMethods Managed File Transfer is vulnerable to Improper Access Control and Allocation of Resources without Limits or Throttling	6 Aug 202613:36	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Streams	6 Sep 202614:48	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance	10 Aug 202611:37	–	ibm
IBM Security Bulletins	Security Bulletin:Netty TLS ClientHello Length Vulnerability: Unbounded Memory Allocation	6 Oct 202617:55	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilies in Netty impacting IBM webMethods API Management	2 Sep 202613:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a Resource Allocation Vulnerability in Netty (CVE-2026-45416)	21 Jul 202621:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	18 Jun 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	7 Jul 202619:10	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software	22 Sep 202607:28	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9	noarch	rh-sso7-keycloak	18.0.20-1.redhat_00001.1.el9sso	rh-sso7-keycloak-18.0.20-1.redhat_00001.1.el9sso.noarch.rpm
Red Hat Enterprise Linux	9	noarch	rh-sso7-keycloak-server	18.0.20-1.redhat_00001.1.el9sso	rh-sso7-keycloak-server-18.0.20-1.redhat_00001.1.el9sso.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-45416
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/netty/netty/releases/tag/netty-4.1.135.Final
github	www.github.com/netty/netty/releases/tag/netty-4.2.15.Final
github	www.github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-45416
cve	www.cve.org/CVERecord

09 Oct 2026 03:47Current

7.1High risk

Vulners AI Score7.1

CVSS 3.17.5

EPSS0.01576

SSVC

Netty Denial of Service TLS handshake SslClientHelloHandler.decode()memory consumption unix