Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Netty (CVE-2026-56816)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Uncontrolled Resource Consumption in Netty, due to a flaw in Netty's Http3FrameCodec that allows it to buffer incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits. Netty is used in our...