42 matches found
CLEANSTART-2026-FB52227 flaw was found in Netty's HttpServerCodec
Security vulnerability affects the elasticsearch package. A flaw was found in Netty's HttpServerCodec...
SUSE CVE-2026-100666
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
CVE-2026-100666
A flaw was found in Netty's HttpServerCodec. A remote attacker can exploit this vulnerability to cause HTTP response desynchronization, leading to response splitting and potential information disclosure. By sending pipelined requests with informational headers followed by another request, the...
Linux Distros Unpatched Vulnerability : CVE-2026-100666
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each...
Linux Distros Unpatched Vulnerability : CVE-2026-100656
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each...
HTTP Request Smuggling
Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the isContentAlwaysEmpty method of HttpServerCodec, which calls...
CVE-2026-100666
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
CVE-2026-100656
Rejected reason: This CVE ID has been rejected as a duplicate...
DEBIAN-CVE-2026-100656
Bulletin has no description...
CVE-2026-100666
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
UBUNTU-CVE-2026-100666
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
EUVD-2026-87760
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
CVE-2026-100666
The io.netty:netty-codec-http component in Netty's HttpServerCodec is vulnerable in versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final . The root cause is that the codec pairs outbound responses with inbound requests by calling pollMethod() once per response, including 1xx informat...
CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
CVE-2026-100666
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
CVE-2026-100666
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
CVE-2026-100656 Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining
Netty io.netty:netty-codec-http contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to...