Linux Distros Unpatched Vulnerability : CVE-2026-100656

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each...

CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

DEBIAN-CVE-2026-100656

Bulletin has no description...

CVE-2026-100658

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-100655

Rejected reason: This CVE ID has been rejected as a duplicate...

DEBIAN-CVE-2026-100655

Bulletin has no description...

CVE-2026-100656

Rejected reason: This CVE ID has been rejected as a duplicate...

EUVD-2026-87752

Netty io.netty:netty-codec-http contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue siz...

CVE-2026-100658

The Netty component (io.netty:netty-codec-http ) is vulnerable to a denial-of-service (DoS) attack due to an unbounded per-connection queue in WebSocketServerExtensionHandler . An unauthenticated remote peer can use HTTP/1.1 pipelining to send requests faster than the application produces respons...

CVE-2026-100658

Removed by vendor...

CVE-2026-100656

The Netty library (io.netty:netty-codec-http ) contains an unbounded per-connection queue growth flaw in HttpServerCodec . The component tracks HTTP methods of unanswered pipelined requests; while the first 32 entries are bit-packed, additional entries are appended to an ArrayDeque (methodOverflo...

CVE-2026-100656

Removed by vendor...

CVE-2026-100655

...

CVE-2026-100655 Netty before 4.1.138.Final Denial of Service via SpdySessionHandler

Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...

CVE-2026-100655

...

CVE-2026-100655

A flaw in Netty (specifically io.netty:netty-codec-http) allows a remote attacker to cause a Denial of Service (DoS) by exhausting server memory. The SpdySessionHandler defaults the localConcurrentStreams limit to Integer.MAX_VALUE without providing an API to restrict it. An attacker can open a S...

EUVD-2026-87749

Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...

SUSE CVE-2026-93574

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header

A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the CorsHandler component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the...