ROS-20260901-73-0043

The vulnerability in Netty is related to the use of insufficiently random values. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260901-73-0044

The vulnerability in Netty is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260901-73-0039

The vulnerability in Netty is related to the lack of memory release after the effective service life. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260901-73-0041

The vulnerability in Netty is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260901-73-0047

The vulnerability in Netty is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260901-73-0049

The vulnerability in Netty is related to the incorrect checking of the specified data type for input data. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

ROS-20260901-73-0046

The vulnerability in Netty is related to incorrect handling of exceptional states. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

CVE-2026-59903

A flaw was found in Netty, an asynchronous, event-driven network application framework. The CorsHandler component incorrectly replaces application Vary headers, such as Authorization or Cookie, with Origin. This allows a caching proxy or Content Delivery Network CDN to reuse authenticated respons...

CVE-2026-62380

A flaw was found in the Netty SOCKS client encoders. This vulnerability allows a remote attacker to inject null bytes or Carriage Return Line Feed CRLF characters into domain address and authentication fields due to insufficient validation. By manipulating these fields, an attacker can truncate o...

CVE-2026-62243

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

ROS-20260831-73-0011

The vulnerability of the HttpObjectDecoder component in the framework for developing network applications, servers, and Netty protocol clients is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected...

ROS-20260831-73-0012

The vulnerability of the SimpleTrustManagerFactory component in the TSL client of the networking application development framework for Netty involves errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle”...

Linux Distros Unpatched Vulnerability : CVE-2026-75329

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full...

Security Bulletin: Security Vulnerability in Netty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-33870 CVE-2026-33871)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Netty Vulnerability Details CVEID:CVE-2026-33870 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty...

SUSE CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

Security Bulletin: Security Vulnerability in Netty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-67735)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Netty Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the...

Security Bulletin: IBM SPSS Modeler is affected by a denial-of-service vulnerability in Netty

Summary IBM SPSS Modeler is affected by a denial-of-service vulnerability in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59901 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and...

Security Bulletin: Multiple security vulnerabilites identified in open source libraries shipped with IBM Guardium Cryptography Manager (GCM)

Summary The vulnerabilities were found in dependent open source libraries used within IBM Guardium Cryptography Manager code base. These issues have been addressed by updating the versions of affected libraries. Vulnerability Details CVEID:CVE-2026-47838 DESCRIPTION: SubjectDnX509PrincipalExtract...

EUVD-2026-66819

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52...

EUVD-2026-66831

The vulnerability occurs when a client sends HTTP/1.1 pipelined requests over a single connection, causing the Reactor Netty HTTP server to consume an excessive amount of memory. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...