ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +1215 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-haproxy MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-haproxy and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10070 more potentially affected by CVE-2026-48059 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.134.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

CVE-2026-48059

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nest...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +34605 more potentially affected by CVE-2026-48043 via io.netty:netty-codec-http2 (>=4.1.0.beta4, <=4.1.134.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +4502 more potentially affected by CVE-2026-48043 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.14.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-48043 Source advisory: MEND:CVE-2026-48043...

CVE-2026-48043

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the "DelegatingDecompressorFrameListener" class orchestrates HTTP/2 decompression by embedding a per-stream "EmbeddedChannel" that runs...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4655 more potentially affected by CVE-2026-48006 via io.netty:netty-codec-redis (>=4.1.0.final, <=4.1.134.final)

io.netty:netty-codec-redis MAVEN version =4.1.0.final, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source cve...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +849 more potentially affected by CVE-2026-48006 via io.netty:netty-codec-redis (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-redis MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-redis and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +4487 more potentially affected by CVE-2026-47244 via io.netty:netty-codec-http2 (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.final, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-47244 Source advisory: MEND:CVE-2026-47244...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +34605 more potentially affected by CVE-2026-47244 via io.netty:netty-codec-http2 (>=4.1.0.beta4, <=4.1.134.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

Information Disclosure

netty incubator codec.bhttp is vulnerable to information disclosure. The vulnerability is due to an improper fallback mechanism used to derive native memory addresses for cryptographic operations when sun.misc.Unsafe is unavailable, which allows an unauthenticated attacker to send crafted OHTTP...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +1889 more potentially affected by CVE-2026-44894 via io.netty:netty-codec-classes-quic (>=4.2.1.final, <=4.2.14.final)

io.netty:netty-codec-classes-quic MAVEN version =4.2.1.final, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-44894 Source advisory: MEND:CVE-2026-44894...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10070 more potentially affected by CVE-2026-44893 via io.netty:netty-codec-haproxy (>=4.1.21.final, <=4.1.134.final)

io.netty:netty-codec-haproxy MAVEN version =4.1.21.final, =0.0.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0, =0.1.0, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91,...

CVE-2026-44893

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2TYPESSL TLV, HAProxyMessage.readNextTLV first calls "header.retainedSliceheader.readerIndex, length" and only then...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +1215 more potentially affected by CVE-2026-44893 via io.netty:netty-codec-haproxy (>=4.2.0.final, <=4.2.14.final)

io.netty:netty-codec-haproxy MAVEN version =4.2.0.final, =4.2.14.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-haproxy and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +1849 more potentially affected by CVE-2026-44892 via io.netty:netty-codec-http3 (>=4.2.2.final, <=4.2.14.final)

io.netty:netty-codec-http3 MAVEN version =4.2.2.final, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-44892 Source advisory: MEND:CVE-2026-44892...

CVE-2026-48748: Allocation of Resources Without Limits or Throttling

Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OO...

CVE-2026-44893: Improper Check or Handling of Exceptional Conditions

Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2TYPESSL TLV, HAProxyMessage.readNextTLV first calls header.retainedSliceheader.readerIndex, length and only then...

CVE-2026-48059: Missing Release of Memory after Effective Lifetime

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nest...

CVE-2026-48043: Uncontrolled Resource Consumption

Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the DelegatingDecompressorFrameListener class orchestrates HTTP/2 decompression by embedding a per-stream EmbeddedChannel that runs the...