PT-2026-63551

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description Netty's STOMP encoder StompSubframeEncoder fails to escape or validate header values in CONNECT and CONNECTED frames. This occurs because the encoder...

The vulnerability affects the classes HAProxyMessage and HAProxyMessageEncoder of the Netty framework, which is used for developing network applications, servers, and client protocols. This vulnerability allows an attacker to replace the original data with malicious content.

The vulnerability of the HAProxyMessage and HAProxyMessageEncoder classes in the Netty framework for developing network applications, servers, and clients is related to the failure to handle CRLF sequences properly. Exploiting this vulnerability can allow an attacker to replace legitimate data wi...

The decoder of the SpdyFrameCodec framework for developing network applications, servers, and clients uses the Netty protocol. This vulnerability allows attackers to cause a service failure.

The vulnerability of the SpdyFrameCodec decoder in the networking application development framework, related to servers and clients using the Netty protocol, involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

PT-2026-63552

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description Netty's HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into...

Allocation of Resources Without Limits or Throttling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SpdyHttpDecoder. An attacker can...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HAProxyMessageDecoder. An attacker can cause unbounded memory allocation by sending a specially crafted PROXY protocol v2 binary prefix with a version byte of 0xFF, which...

Incorrect Authorization

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Incorrect Authorization in the CorsHandler. An attacker can gain unauthorized access to...

Allocation of Resources Without Limits or Throttling

Overview io.netty:netty-codec-http2 is a HTTP2 sub package for the netty library, an event-driven asynchronous network application framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Http2Decompressor.decompress. An attacker c...

DEBIAN-CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

CVE-2026-56819

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content...

DEBIAN-CVE-2026-56819

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content...

CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

DEBIAN-CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

UBUNTU-CVE-2026-56819

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content...

UBUNTU-CVE-2026-56817

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing XmlDecoder can send XML with a DOCTYPE declaration...

UBUNTU-CVE-2026-56820

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID, which can lead to replay...

CVE-2026-56820

Netty’s OcspClient vulnerability (CVE-2026-56820) allows a replay attack by not validating the CertificateID in OCSP responses. A forged or unrelated-but-signed OCSP response can be accepted for another certificate issued by the same CA, bypassing revocation checks. Affected versions: 4.2.0.Final...