CVE-2026-76816 Netty: MQTT Topic Name and Client ID Validation Bypass

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty , an asynchronous event-driven network framework, contains a validation bypass in its MqttEncoder prior to versions 4.1.137.Final and 4.2.17.Final . The encoder fails to validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null by...

EUVD-2026-65093

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

CVE-2026-76816

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and...

OPENSUSE-SU-2026:21629-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue: - CVE-2026-52718: byte count instead of a bit count in gstav1parserparsetilelistobu can cause parser desynchronization and an application crash bsc1268394...

SUSE-SU-2026:23274-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issue: - CVE-2026-52718: byte count instead of a bit count in gstav1parserparsetilelistobu can cause parser desynchronization and an application crash bsc1268394...

PT-2026-81028

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.137.Final Netty versions prior to 4.2.17.Final Description Netty is an asynchronous, event-driven network application framework. The MqttEncoder does not validate client identifiers, will topics, usernames, and...

Null Byte Interaction Error (Poison Null Byte)

Overview Affected versions of this package are vulnerable to Null Byte Interaction Error Poison Null Byte via the Socks4ClientEncoder and Socks5ClientEncoder in codec-socks. An attacker can truncate or alter encoded SOCKS requests by supplying userId, destination host, username, or password value...

CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-43678

A flaw was found in swift-nio. An unauthenticated remote attacker can crash any NIOWebSocket-based server by sending a single 11-byte frame after a completed WebSocket handshake. This vulnerability leads to a Denial of Service DoS, dropping all active connections until the server process restarts...

CVE-2026-62381 luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overflow

luci-lib-px5g LuCI contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1addobj x509write.c when signing a certificate with a 2040-bit RSA key. For a 255-byte signature, the BIT STRING allocation is computed from the DER length encoding of 255 bytes, but the payload writt...

CVE-2026-62380

Netty (io.netty:netty-codec-socks) versions 4.1.x through 4.1.136.Final and 4.2.0.Final through 4.2.16.Final contain null byte and CRLF injection vulnerabilities in the Socks4ClientEncoder and Socks5ClientEncoder . The encoders fail to validate domain address and authentication (username/password...

EUVD-2026-64272

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

SUSE CVE-2026-63385

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

CVE-2026-62380: Null Byte Interaction Error (Poison Null Byte)

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

Linux Distros Unpatched Vulnerability : CVE-2026-62380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection...

PT-2026-79547

Name of the Vulnerable Software and Affected Versions Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final Netty io.netty:netty-codec-socks versions 4.1.x through 4.1.136.Final Description Null byte, CRLF, and credential injection issues exist in the SOCKS4 Socks4ClientEncod...