CVE-2026-62380

Netty io.netty:netty-codec-socks versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 Socks4ClientEncoder and SOCKS5 Socks5ClientEncoder client encoders, which fail to validate domain address and...

CVE-2026-61799

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:08+00:00| published-proof-of-concept| https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-pgrf-4654-3gq8...

CVE-2026-63202

creationtimestamp| type| source ---|---|--- 2026-08-20 20:35:03+00:00| published-proof-of-concept| https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-4899-mpch-38p3...

netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding

BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding - ID: BHTTP-LOOP-001 - Severity: High - CVSS v3.1: 7.5 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CWE: CWE-835 Loop with Unreachable Exit Condition — secondary CWE-400 Uncontrolled Resource...

netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields

We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...

netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary

Summary io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can us...

netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash

Summary io.netty.incubator:netty-incubator-codec-bhttp uses attacker-controlled Binary HTTP variable-length integers as long values but accumulates them into int offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked ArrayIndexOutOfBoundsException /...

netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...

GHSA-2MC4-J865-9Q4R netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...

netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

The netty-incubator-codec-ohttp library implements Oblivious HTTP OHTTP gateway and client functionality using Netty's ByteBuf memory management. When an OHTTP gateway processes encrypted client requests, it allocates a pooled direct native off-heap ByteBuf to hold the decrypted plaintext before...

CVE-2026-74300

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI component. A malicious Bluetooth controller could send a specially crafted response during the 'Read Local Codec Capabilities' operation. Insufficient validation of the codec capability element length could allow the...

Linux Distros Unpatched Vulnerability : CVE-2026-63633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls...

Linux Distros Unpatched Vulnerability : CVE-2026-69159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planardecompressplanerle and planardecompressplanerleonly in...

CVE-2026-76395

In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could execute arbitrary code on the Splunk server by loading a model file containing crafted sparse matrix data. The deserialization of untrusted data is possible because a model codec in Splunk AI Toolkit...

CVE-2026-69159

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-67306. Reason: This candidate is a duplicate of CVE-2026-67306. Notes: All CVE users should reference CVE-2026-67306 instead of this candidate...

CVE-2026-63633

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...

EUVD-2026-62673

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.29.0, planardecompressplanerle and planardecompressplanerleonly in libfreerdp/codec/planar.c verify that a control byte exists but do not verify that the source buffer contains the zero to fifteen raw bytes declared by th...

CVE-2026-63633 FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context-common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that...

MINI-G722-65HM-PGGJ

Bulletin has no description...

PSF-2026-37

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 the "idna" codec and the intable...