Security Bulletin:There are multiple vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite

Summary There are multiple vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite. This bulletin contains information regarding these vulnerabilities and their fixtures. Vulnerability Details CVEID:CVE-2026-75595 DESCRIPTION: Netty is an asynchronous, event-driven networ...

Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

Security Bulletin: Vulnerability in Netty affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Netty has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty (CVE-2026-62243, CVE-2026-75595, CVE-2026-75596)

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple issues in Netty: Improper Validation of Certificate with Host Mismatch, Improper Check for Unusual or Exceptional Conditions, and Inefficient Algorithmic Complexity. Netty is used in our Speech microservices. These...

Atlassian Confluence < 9.2.26 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104520)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104520 advisory. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final,...

Atlassian Jira Service Management Data Center and Server 5.9.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16781)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16781 advisory. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and...

RCE (Remote Code Execution) io.netty:netty-handler Dependency in Jira Software Data Center

This is a vulnerability in a non-Atlassian Jira Software Data Center dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity RCE Remote Code Execution vulnerability was introduced in versions 10.3.0 and 11.3.0 of Jira Software Da...

Security Bulletin:Netty Vulnerability: IndexOutOfBoundsException in SslClientHelloHandler Leading to Mutual TLS Bypass

Summary Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records c...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

RCE (Remote Code Execution) io.netty:netty-handler Dependency in Jira Service Management Data Center

This is a vulnerability in a non-Atlassian Jira Service Management dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity RCE Remote Code Execution vulnerability was introduced in versions 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0,...

SUSE CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-61799

"io.netty.incubator:netty-incubator-codec-bhttp" uses attacker-controlled Binary HTTP variable-length integers as "long" values but accumulates them into "int" offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked "ArrayIndexOutOfBoundsException" /...

CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

DEBIAN-CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-75595

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-75595: Improper Check for Unusual or Exceptional Conditions

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

PT-2026-78717

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.137.Final Netty versions prior to 4.2.17.Final Description An issue exists in the decode function of io.netty.handler.ssl.SslClientHelloHandler where an incorrect offset is checked before reading the four-byte TLS...