Linux Distros Unpatched Vulnerability : CVE-2026-100655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent...

Linux Distros Unpatched Vulnerability : CVE-2026-100656

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +6081 more potentially affected by CVE-2026-100666 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.16.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-100666 Source advisory: SNYK:JAVA-IONETTY-20154836...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +43960 more potentially affected by CVE-2026-100666 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.136.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

DEBIAN-CVE-2026-100655

Bulletin has no description...

DEBIAN-CVE-2026-100656

Bulletin has no description...

CVE-2026-100655

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-100656

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-100658

Rejected reason: This CVE ID has been rejected as a duplicate...

EUVD-2026-87752

Netty io.netty:netty-codec-http contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue siz...

CVE-2026-100658

Removed by vendor...

CVE-2026-100658

The Netty component (io.netty:netty-codec-http ) is vulnerable to a denial-of-service (DoS) attack due to an unbounded per-connection queue in WebSocketServerExtensionHandler . An unauthenticated remote peer can use HTTP/1.1 pipelining to send requests faster than the application produces respons...

CVE-2026-100656

Removed by vendor...

CVE-2026-100656

The Netty library (io.netty:netty-codec-http ) contains an unbounded per-connection queue growth flaw in HttpServerCodec . The component tracks HTTP methods of unanswered pipelined requests; while the first 32 entries are bit-packed, additional entries are appended to an ArrayDeque (methodOverflo...

CVE-2026-100655 Netty before 4.1.138.Final Denial of Service via SpdySessionHandler

Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...

EUVD-2026-87749

Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...

CVE-2026-100655

...

CVE-2026-100655

A flaw in Netty (specifically io.netty:netty-codec-http) allows a remote attacker to cause a Denial of Service (DoS) by exhausting server memory. The SpdySessionHandler defaults the localConcurrentStreams limit to Integer.MAX_VALUE without providing an API to restrict it. An attacker can open a S...

CVE-2026-100655

...