HTTP Request Smuggling io.netty:netty-codec-http Dependency in Jira Data Center

This High severity HTTP Request Smuggling vulnerability was introduced in versions 9.12.1, 9.16.0, 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center and Server. This HTTP Request Smuggling vulnerability, with a...

ANT-2026-HN9XZXJ9 · freerdp · heap

heap-buffer-overflow critical CVE-2026-45700 GHSA-mpxh-8fq3-x8mh GHSA-mvpx-xj7r-3p3r GHSA-p6r2-4hgm-m6ff Severity Claude critical · Security research firm critical revised; sealed as medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sofsdwrtsdcajackcommon: ctx-headsetcodecdev = NULL The function sofsdwRtsdcajackexit is used by different codecs, and some of them use the same interface name dai. For example, rt712 and rt713 both use...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek – Assign a dummy codec when no specific codec is specified for a DAI link. MediaTek sound card drivers check whether a DAI link exists and is being used on a board. They assign the correct parameters to the DAI lin...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ASoC: codec: sma1307: Fixed memory corruption in sma1307settingloaded The sma1307-setheadersize field specifies the number of integers in the header there are 8 such integers. However, instead of allocating 8 integers’ worth of...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Unregister codec device on unbind When the device is bound, we register the HDMI codec device. However, we do not unregister it when the device is unbound, resulting in a situation where the device remains active a...

Security Bulletin: DevOps Test Performance contains vulnerabilities related to use of netty-codec-http

Summary Due to use of netty-codec-http, DevOps Test Performance and Rational Performance Tester contain potential resource exhaustion and denial-of-service DoS vulnerabilities Vulnerability Details CVEID:CVE-2025-58057 DESCRIPTION: Netty is an asynchronous event-driven network application framewo...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.132.Final.jar

Summary IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-http-4.1.132.Final.jar Vulnerability Details CVEID:CVE-2026-41417 DESCRIPTION: Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is...

iLBC audio codec DoS

The vulnerability of the iLBC audio codec used by Wireshark, a network traffic analyzer, is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow attackers to cause system failures...

Wireshark iLBC DoS

The vulnerability of the iLBC packet analyzer in Wireshark relates to a memory reclamation error. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

ffmpeg:ffmpeg_AV_CODEC_ID_SANM_fuzzer: Heap-buffer-overflow in codec47_block

Project: https://git.ffmpeg.org/ffmpeg.git https://github.com/FFmpeg/FFmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5024854725427200 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDSANMfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type:...

DEBIAN-CVE-2026-42586

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder RedisEncoder writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF \r\n characters. Since the...

CVE-2026-42584

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103,...

UBUNTU-CVE-2026-42579

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit t...

UBUNTU-CVE-2026-42584

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103,...

EUVD-2026-30014

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1011: Use component to get the dapm context in spkmodeput The correct helper to use in rt1011recvspkmodeput to retrieve the DAPM context is sndsoccomponenttodapm, from kcontrol we will receive NULL pointer...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4876 more potentially affected by CVE-2026-44248 via io.netty:netty-codec-mqtt (>=4.1.5.final, <=4.1.132.final)

io.netty:netty-codec-mqtt MAVEN version =4.1.5.final, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.2, =0.0.2, =0.0.2, =0.3.0 and more Source cves:...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +820 more potentially affected by CVE-2026-44248 via io.netty:netty-codec-mqtt (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-mqtt MAVEN version =4.2.0.alpha1, =4.2.12.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-mqtt and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +43381 more potentially affected by CVE-2026-42587 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.132.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +4669 more potentially affected by CVE-2026-42587 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-42587 Source advisory: MEND:CVE-2026-42587...