414 matches found
Security Bulletin: IBM Maximo Application Suite - Monitor Component uses netty-codec-http2-4.2.10.Final.jar, netty-codec-http2-4.2.9.Final.jar which is vulnerable to CVE-2026-33871
Summary Security Bulletin: IBM Maximo Application Suite - Monitor Component uses netty-codec-http2-4.2.10.Final.jar, netty-codec-http2-4.2.9.Final.jar which is vulnerable to CVE-2026-33871.This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-33871...
Security Bulletin: IBM Maximo Application Suite - Monitor Component uses netty-codec-http-4.2.9.Final.jar which is vulnerable to CVE-2026-33870
Summary IBM Maximo Application Suite - Monitor Component uses netty-codec-http-4.2.9.Final.jar which is vulnerable to CVE-2026-33870.This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2026-33870 DESCRIPTION: Netty is an asynchronous, event-driven...
CVE-2026-42584
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for April 2026.
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation. Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In...
Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
Summary Maximo AI Service uses path-to-regexp-0.1.12.tgz, mlflow-3.9.0rc0-py3-none-any.whl, lodash-4.17.23.tgz, tomcat-embed-core-10.1.53.jar, spring-security-config-6.5.9.jar, Mako-1.3.8-py3-none-any.whl, uuid-11.1.0.tgz, spring-boot-3.5.13.jar, mako-1.3.11-py3-none-any.whl and...
Security Bulletin: A netty-codec-http-4.1.118.Final.jar vulnerability found by Scanner affects IBM Rational Functional Tester / DevOps Test UI
Summary There is a vulnerability in netty-codec-http-4.1.118.Final.jar used by Rational Functional Tester RFT / DevOps Test UI Test UI. RFT/Test UI has addressed the applicable CVE Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application...
Astra Linux – Vulnerability in Netty
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. Before version 4.1.59.Final, there was a vulnerability on Unix-like systems involving an insecure temporary file. When Netty’s...
Astra Linux – Vulnerability in Netty
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. In Netty-Codec-Compression versions 4.1.124.Final and below, as well as Netty-Codec versions 4.2.4.Final and below, when supplied with specially...
Astra Linux – Vulnerability in Netty
Netty is an asynchronous event-driven network application framework for developing maintainable, high-performance protocol servers and clients. In versions 4.1.124.Final and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters LF as a chunk-size line terminato...
Astra Linux – Vulnerability in Netty
The Netty project is an event-driven, asynchronous network application framework. Starting from version 4.1.83.Final and before 4.1.86.Final, when calling DefaultHttpHeaders.set with an iterator of values, header value validation was not performed. This allowed malicious header values in the...
Astra Linux – Vulnerability in Netty
In Netty 4.1.x before 4.1.46, the ZlibDecoders allowed unbounded memory allocation when decoding Zlib-encoded byte streams. An attacker could send a large Zlib-encoded byte stream to the Netty server, forcing the server to allocate all of its available memory to a single decoder...
Astra Linux – Vulnerability in Netty
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty was vulnerable to MadeYouReset DDoS attacks. This is a logical vulnerability in the HTTP/2 protocol, which exploits malformed HTTP/2 control frames to break the maximum...
Astra Linux – Vulnerability in Netty
The HttpObjectDecoder.java file in Netty before version 4.1.44 allowed a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header...
Astra Linux – Vulnerability in Netty
HttpObjectDecoder.java in Netty before 4.1.44 allowed an HTTP header that lacked a colon. This could be interpreted as a separate header with incorrect syntax, or it could be interpreted as an “invalid fold”...
Astra Linux – Vulnerability in Netty
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. In Netty io.netty:netty-codec-http2 before version 4.1.61.Final, there is a vulnerability that allows for request smuggling. This...
CVE-2026-41417
A flaw was found in Netty. A remote attacker can bypass request-line validation by manipulating the URI after a DefaultHttpRequest or DefaultFullHttpRequest is created. This vulnerability, a form of Carriage Return Line Feed CRLF injection, allows for the insertion of additional HTTP or RTSP...
SUSE CVE-2026-42578
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage method creates headers using...
SUSE CVE-2026-42584
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103,...
Linux Distros Unpatched Vulnerability : CVE-2026-42578
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT...
Linux Distros Unpatched Vulnerability : CVE-2026-42581
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting...