CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the encodeHeaders in the STOMP frame encoder, which fails to validate or escape newline characters in header values for certain commands. An attacker can inject arbitrary headers by including newline characters in...

Improper Check for Certificate Revocation

Overview io.netty:netty-handler-ssl-ocsp is a Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in t...

Improper Certificate Validation

Overview io.netty:netty-handler-ssl-ocsp is a Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients. Affected versions of this package are vulnerable to Improper Certificate Validation in the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HAProxyMessageDecoder. An attacker can cause unbounded memory allocation by sending a specially crafted PROXY protocol v2 binary prefix with a version byte of 0xFF, which...

HPESBNW05076 rev.1 - HPE Telco Intelligent Assurance, Multiple Vulnerabilities

Potential Security Impact: Remote: Denial of Service DoS, Gain Privileged Access SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Intelligent Assurance 4.2.15 and below - FAS and PDO CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2026-44249 |...

SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:2802-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2802-1 advisory. This update for netty, netty-tcnative fixes the following issue This update for netty, netty-tcnative fixes th...

SUSE-SU-2026:2802-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issue This update for netty, netty-tcnative fixes the following issues Upgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79: - CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking...

SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:2308-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2308-1 advisory. This update for netty, netty-tcnative fixes the following issues - CVE-2026-41417: missing validations leads t...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in RedisArrayAggregator. An attacker who sends a small RESP array header declaring a very large element count can force the aggregator to reserve a large ArrayList via the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in shouldWaitForDynamicTableUpdates in QpackDecoder. An attacker can open an indefinite number of persistently blocked streams by sending headers that reference dynamic table entries...

SUSE-SU-2026:2308-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues - CVE-2026-41417: missing validations leads to HTTP request smuggling and RTSP request injection via start-line injection in DefaultHttpRequest.setUri bsc1264350. - CVE-2026-42578: HTTP Header Injection via HttpProxyHandler Disabled...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +3026 more potentially affected by CVE-2026-47244 via io.netty:netty-codec-http2 (>=4.2.0.Final <=4.2.14.Final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.Final, =0.1.0, =0.1.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.2 and more Source cves: CVE-2026-47244 Source advisory: OSV:GHSA-5X3R-WRVG-RP6Q...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to unbounded nesting of composite buffers in the SCTP message reassembly process. An attacker can exhaust system memory and cause a denial of service by sending a large number of...

Improper Verification of Source of a Communication Channel

Overview Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel due to improper validation in the validateToken function. An attacker can cause the server to treat unvalidated client addresses as validated by supplying any non-empty token...

Insecure Default Initialization of Resource

Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource due to the lack of an enforced maximum header size limit in the default configuration of the Http3ConnectionHandler. An attacker can exhaust server memory and cause application crashes by...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in the handling of TCP connections with ALLOWHALFCLOSURE enabled when a remote peer sends a FIN followed by a RST. An attacker can cause resource exhaustion or high CPU utilization by...

SUSE-SU-2026:1353-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: Upidate to 4.1.132: - CVE-2026-33870: incorrectly parses quoted strings in HTTP/1.1 can lead to request smuggling bsc1261031. - CVE-2026-33871: sending a flood of CONTINUATION frames can lead to a denial of service bsc1261043...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the parsing of quoted strings within chunked transfer encoding extension values. An attacker can inject arbitrary HTTP requests into a connection by crafting chunk extensions containing carriage return or line...

SUSE-SU-2025:03114-1 Security update for netty, netty-tcnative

This update for netty, netty-tcnative fixes the following issues: Upgrade to upstream version 4.1.126. Security issues fixed: - CVE-2025-58057: decompression codecs allocating a large number of buffers after processing specially crafted input can cause a denial of service bsc1249134. -...

Linux Distros Unpatched Vulnerability : CVE-2021-43797

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty pri...