Linux Distros Unpatched Vulnerability : CVE-2026-56817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...

Linux Distros Unpatched Vulnerability : CVE-2026-55851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and...

Linux Distros Unpatched Vulnerability : CVE-2026-56745

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through...

Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Summary An attacker can cause Denial of Service by sending a specially crafted malicious XML payload e.g., repeated . Because the parser state is not saved between decode invocations, an attacker can trickle-feed a payload of / characters. This forces the decoder to repeatedly rescan the entire...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the XmlFrameDecoder process. An attacker can cause the server's EventLoop thread to exhaust CPU resources and become unresponsive by sending a specially crafted XML payload, such as repeated /...

GHSA-V74W-7MR3-4QG3 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion

Summary An attacker can cause Denial of Service by sending a specially crafted malicious XML payload e.g., repeated . Because the parser state is not saved between decode invocations, an attacker can trickle-feed a payload of / characters. This forces the decoder to repeatedly rescan the entire...

GHSA-MFG7-5GFP-C4W3 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names

Summary A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service. Details Inside...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime in AbstractDnsRecord and DefaultDnsRecordDecoder, where a domain name that violates IDNA rules makes IDN.toASCII throw before the decoded ByteBuf is assigned to the record's content,...

PT-2026-71668

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description An issue exists where the framework fails to release retained or newly allocated ByteBuf objects when a malformed domain name is rejected by IDN.toASCII or...

PT-2026-71667

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description An unauthenticated remote attacker can cause a denial of service by sending repeated / sequences to the decode function within...

PT-2026-65342

Summary A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service. Details Inside...

Oracle GoldenGate for Big Data Multiple Vulnerabilities 23.x < 23.26.3.0.0 (July 2026 CPU)

According to its self-reported version number, the Oracle GoldenGate for Big Data application located on the remote host is affected by multiple vulnerabilities: - Vulnerability in the Oracle GoldenGate Big Data and Application Adapters product of Oracle GoldenGate component: Third Party Eclipse...

Security Bulletin: IBM Sterling Connect:Direct Web Services is Affected by Multiple Vulnerabilities.

Summary netty-resolver-dns-4.2.13.Final.jar is used by IBM Sterling Connect:Direct Web Services CVE-2026-45673, CVE-2026-45674, CVE-2026-47691. Vulnerability Details CVEID:CVE-2026-45673 DESCRIPTION: Netty is a network application framework for development of protocol servers and clients. Prior t...

CVE-2026-56816

creationtimestamp| type| source ---|---|--- 2026-07-22 22:35:17+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv...

CVE-2026-56821

creationtimestamp| type| source ---|---|--- 2026-07-22 22:35:12+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmr 2026-07-29 02:57:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqwjehar622 2026-07-29 12:15:13+00:00| seen|...

CVE-2026-56822

creationtimestamp| type| source ---|---|--- 2026-07-22 22:35:10+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f 2026-07-29 02:48:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqvzcxpus2j 2026-07-29 12:15:10+00:00| seen|...

CVE-2026-59919

creationtimestamp| type| source ---|---|--- 2026-07-22 22:35:08+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h...

CVE-2026-59920

creationtimestamp| type| source ---|---|--- 2026-07-22 22:35:05+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh...

CVE-2026-59921

creationtimestamp| type| source ---|---|--- 2026-07-22 22:35:03+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g 2026-07-29 02:43:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrqvpsdzvg2e 2026-08-10 13:20:14+00:00| seen|...

GHSA-GCJF-9MGH-3P7G Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder 1. Vulnerability Summary | Field | Value | |-------|-------| | Product | Netty | | Version | 4.2.12.Final and all prior versions with codec-http multipart | | Component |...