Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance

Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-44250, CVE-2026-44890 Vulnerability Details CVEID:CVE-2026-44250 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In...

Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance

Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-42583 Vulnerability Details CVEID:CVE-2026-42583 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final,...

Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance

Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-44248 Vulnerability Details CVEID:CVE-2026-44248 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, t...

Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance

Summary The Netty package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVECVE-2026-42586 Vulnerability Details CVEID:CVE-2026-42586 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, t...

netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling

A flaw was found in Netty, a network application framework. A local attacker could exploit a vulnerability in the nettyunixsocketrecvFd function when handling SCMRIGHTS messages in Epoll or KQueue DomainSocketChannel with DomainSocketReadMode.FILEDESCRIPTORS enabled. Incorrect handling of file...

netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager X509TrustManager, it fails to perform...

Uncontrolled Resource Consumption (Denial Of Service)

Netty is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to improper handling of the HAProxy protocol version byte in the HAProxyMessageDecoder, where a signed Java byte is widened to an int without masking, causing a crafted 0xFF version byte to be...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec library that could allow a remote attacker to trigger excessive memory allocation by sending specially crafted LZ4-compressed data. (CVE-2026-42583).

Summary IBM Storage Protect Server uses the netty-codec library in certain components. A vulnerability in netty could allow an attacker to trigger excessive memory allocation by sending specially crafted LZ4-compressed data. By providing a small malicious payload that advertises a large...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library that could lead to HTTP request smuggling, desynchronization, or RTSP request injection.(CVE-2026-41417).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow an attacker to inject malicious CRLF sequences into request URIs, resulting in HTTP request smuggling, protocol desynchronization, and the execution of unintended HTTP ...

Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec-http library that could allow remote attacker to send a large number of specially crafted frames, causing excessive CPU consumption (CVE-2026-33871).

Summary IBM Storage Protect Server uses the netty-codec-http library in certain components. A vulnerability in netty could allow remote attacker to send a large number of specially crafted CONTINUATION frames, causing excessive CPU consumption and rendering the server unresponsive. The issue aris...

Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-44249)

Summary There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-44249 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. In...

Security Bulletin: There is a vulnerability in netty-codec-http-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50020)

Summary There is a vulnerability in netty-codec-http-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50020 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...

Security Bulletin: There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50560)

Summary There is a vulnerability in netty-codec-http2-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50560 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...

Security Bulletin: There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2026-50010)

Summary There is a vulnerability in netty-handler-4.1.133.Final.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2026-50010 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior to...

CVE-2026-59898

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 or V08 handshaker by sending Sec-WebSocket-Version: 7 and omitting Connection: Upgrade / Upgrade: websocket headers,...

CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-59919

Netty CVE-2026-59919 affects the HAProxy encoder (HAProxyMessageEncoder) in Netty versions prior to 4.1.136.Final and 4.2.16.Final. The encoder writes AF_UNIX source/destination addresses into the HAProxy V1 text protocol without validating for CRLF, allowing an attacker who controls an AF_UNIX a...

CVE-2026-59920

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder StompSubframeEncoder does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline \n characters in a header value are...

CVE-2026-59920 Netty: STOMP CONNECT Frame Header Injection

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder StompSubframeEncoder does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline \n characters in a header value are...

DEBIAN-CVE-2026-56821

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path...