CLEANSTART-2026-HJ08355 Netty is an asynchronous, event-driven network application framework

CVE-2026-59903 affects multiple packages. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details...

CLEANSTART-2026-LI34904 Security fixes in strimzi-kafka-operator 1.2.0-r1

Package strimzi-kafka-operator version 1.2.0-r1 fixes 2 vulnerabilities: CVE-2026-59949, CVE-2026-59903...

CLEANSTART-2026-NW99656 Security fixes in elasticsearch 9.5.2-r1

Package elasticsearch version 9.5.2-r1 fixes 3 vulnerabilities: CVE-2026-64607, CVE-2026-59903, CVE-2026-49844...

CLEANSTART-2026-US56197 Security fixes in elasticsearch 9.5.2-r2

Package elasticsearch version 9.5.2-r2 fixes 3 vulnerabilities: CVE-2026-64607, CVE-2026-59903, CVE-2026-49844...

Linux Distros Unpatched Vulnerability : CVE-2026-59903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler...

CVE-2026-59903

creationtimestamp| type| source ---|---|--- 2026-08-17 19:31:21+00:00| seen| https://gist.github.com/alon710/53c9694ceb5875fbe39960b018952b7c 2026-09-20 05:20:11+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6pl5ah2v 2026-09-20 05:20:13+00:00| seen|...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +43778 more potentially affected by CVE-2026-59903 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.136.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

UBUNTU-CVE-2026-59903

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse...