netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +43409 more potentially affected by CVE-2026-50020 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.134.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +5060 more potentially affected by CVE-2026-50020 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-50020 Source advisory: GHSA-HVCG-QMG6-JM4C...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +5060 more potentially affected by CVE-2026-50020 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-50020 Source advisory: OSV:GHSA-HVCG-QMG6-JM4C...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +844 more potentially affected by CVE-2026-50011 via io.netty:netty-codec-redis (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-redis MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-redis and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +844 more potentially affected by CVE-2026-50011 via io.netty:netty-codec-redis (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-redis MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-redis and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

CVE-2026-44890

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server's direct memory pool, leading to a Denial of Service DoS condition where legitima...

CVE-2026-44250

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion...

CVE-2026-48043

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

CVE-2026-44893

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +43409 more potentially affected by CVE-2026-50020 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.134.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4643 more potentially affected by CVE-2026-50011 via io.netty:netty-codec-redis (>=4.1.0.final, <=4.1.134.final)

io.netty:netty-codec-redis MAVEN version =4.1.0.final, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source cve...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +1875 more potentially affected by CVE-2026-50009 via io.netty:netty-codec-classes-quic (>=4.2.1.final, <=4.2.14.final)

io.netty:netty-codec-classes-quic MAVEN version =4.2.1.final, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-50009 Source advisory: SNYK:JAVA-IONETTY-17337011...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +34567 more potentially affected by CVE-2026-50560 via io.netty:netty-codec-http2 (>=4.1.0.beta4, <=4.1.134.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +4487 more potentially affected by CVE-2026-50560 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.14.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-50560 Source advisory: SNYK:JAVA-IONETTY-17337010...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +1210 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-haproxy MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-haproxy and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10058 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.134.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

CVE-2026-48043

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the "DelegatingDecompressorFrameListener" class orchestrates HTTP/2 decompression by embedding a per-stream "EmbeddedChannel" that runs...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4643 more potentially affected by CVE-2026-48006 via io.netty:netty-codec-redis (>=4.1.0.final, <=4.1.134.final)

io.netty:netty-codec-redis MAVEN version =4.1.0.final, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source cve...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +844 more potentially affected by CVE-2026-48006 via io.netty:netty-codec-redis (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-redis MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-redis and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...