32 matches found
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an OutOfMemoryError and HTTP Request/Response Smuggling in Netty (CVE-2026-89044, CVE-2026-93488)
Summary IBM Watson Speech Services Cartridge is vulnerable to an OutOfMemoryError and HTTP Request/Response Smuggling in Netty. Netty is used in our Speech microservices. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details...
DoS (Denial of Service) io.netty:netty-codec-http Dependency in Crowd Data Center
This High severity DoS Denial of Service vulnerability was introduced in version 7.2.0 of Crowd Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker to expose assets in...
DoS (Denial of Service) io.netty:netty-codec-http Dependency in Bamboo Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 10.2.0, 11.00, 12.0.0 and 12.1.0 of Bamboo Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated...
io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...
Linux Distros Unpatched Vulnerability : CVE-2026-100655
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent...
DEBIAN-CVE-2026-100655
Bulletin has no description...
CVE-2026-100655
Rejected reason: This CVE ID has been rejected as a duplicate...
CVE-2026-100655
A flaw in Netty (specifically io.netty:netty-codec-http) allows a remote attacker to cause a Denial of Service (DoS) by exhausting server memory. The SpdySessionHandler defaults the localConcurrentStreams limit to Integer.MAX_VALUE without providing an API to restrict it. An attacker can open a S...
EUVD-2026-87749
Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...
CVE-2026-100655 Netty before 4.1.138.Final Denial of Service via SpdySessionHandler
Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...
CVE-2026-100655
...
PT-2026-99326
Name of the Vulnerable Software and Affected Versions Netty io.netty:netty-codec-http versions prior to 4.1.138.Final Netty io.netty:netty-codec-http versions 4.2.0.Final through 4.2.17.Final Description The software accepts an unlimited number of concurrent remote-initiated SPDY streams because...
SUSE CVE-2026-93488
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...
io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...
io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...
io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...
Linux Distros Unpatched Vulnerability : CVE-2026-93488
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to...
DEBIAN-CVE-2026-93488
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...
CVE-2026-93488
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...