CLEANSTART-2026-AN70702 Netty is an asynchronous, event-driven network application framework

CVE-2026-42587 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-KB74242 Security fixes in strimzi-kafka-operator 1.1.0-r1

Package strimzi-kafka-operator version 1.1.0-r1 fixes 22 vulnerabilities: CVE-2026-42587, CVE-2026-47244, CVE-2026-48043, CVE-2026-50560, CVE-2026-54512...

CVE-2026-42587

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +34391 more potentially affected by CVE-2026-42587 via io.netty:netty-codec-http2 (>=4.1.0.beta4, <=4.1.132.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...