CVE-2026-55851

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

CVE-2026-55851

CVE-2026-55851 affects Netty (codec-haproxy) where the HAProxyMessageDecoder reads the 13th byte as a signed value and sign-extends to int, causing a PROXY v2 prefix with 0xFF to collide with the decoder’s need-more-data sentinel. This leads to unbounded cumulation and potential memory exhaustion...

CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to but not including 4.2.16.Final, and 4.1.0.Final up to but not including 4.1.135, the HAProxyMessageDecoder in Netty's codec-haproxy module performs protocol version detection by...

Gitea SSH Key Parser Denial of Service

Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 SSH2 format and normalises them before storage. The normalisation function contains an ON² string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work th...

GHSA-4XJF-493Q-98P3 Gitea SSH Key Parser Denial of Service

Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 SSH2 format and normalises them before storage. The normalisation function contains an ON² string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work th...

Malicious code in @apexfdn/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1e0d9d996b5aaae14084ec54f9bd48bdfc6399673f1203aacebdef8abb42692 On npm install, install.cjs runs a postinstall lifecycle script that, on macOS, writes an AppleScript to /tmp and invokes /usr/bin/osascript with 'wi...

MAL-2026-10979 Malicious code in @apexfdn/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1e0d9d996b5aaae14084ec54f9bd48bdfc6399673f1203aacebdef8abb42692 On npm install, install.cjs runs a postinstall lifecycle script that, on macOS, writes an AppleScript to /tmp and invokes /usr/bin/osascript with 'wi...

Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

GHSA-5GGR-2F2H-JMVM Gitea: Local File Inclusion via file:// URI in Migration Restore

Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...

Malicious code in comp-colors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1aad1b8a73afbe28c708c4e19a1495793d1214980f72357a13d07b98f1f9a060 The package hides code to download and execute a remote executable from a newly created fastsyncapi.com domain. It is disguised as a remote 'fast color helper,...

MAL-2026-10986 Malicious code in comp-colors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1aad1b8a73afbe28c708c4e19a1495793d1214980f72357a13d07b98f1f9a060 The package hides code to download and execute a remote executable from a newly created fastsyncapi.com domain. It is disguised as a remote 'fast color helper,...

GHSA-WWQQ-X6W4-FRM2 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...

GHSA-HG5R-VQ93-9FV6 Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Summary Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifact...

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Summary Gitea Actions Artifacts V4 signed upload/download URLs can be rewritten to access a different running task and repository context while preserving the original HMAC signature. An attacker with permission to run a Gitea Actions job can turn a signed URL for an attacker-controlled artifact...

GHSA-V96J-25GV-G2W9 Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to...

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

This issue has been found by a security agent and review by myself. Gitea's CODEOWNERS feature uses the regexp2 library to match file paths against ownership rules. User-supplied patterns are passed directly to regexp2.Compile with no sanitisation and no match timeout. This allows an attacker to...

GHSA-F75J-4CW6-RMX4 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Summary The Gitea Docker images ship an app.ini template that hard-codes: REVERSEPROXYTRUSTEDPROXIES = The documented default for this setting, in custom/conf/app.example.ini, is 127.0.0.0/8,::1/128, i.e. only loopback is trusted. When an admin enables ENABLEREVERSEPROXYAUTHENTICATION = true to p...