5237 matches found
CVE-2026-100657
The Netty STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf leak in the StompSubframeDecoder component. The vulnerability occurs because the decoder allocates a chunk buffer after reading a frame's content length but waits for a terminating NUL byte . If this byte is withheld, the buffe...
CVE-2026-100657
Removed by vendor...
EUVD-2026-87751
Netty's STOMP codec io.netty:netty-codec-stomp contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the decoder allocates a chunk buffer from the channel allocator and parks it in an instance field while waiting for the single NUL byte that...
EUVD-2026-87750
Netty io.netty:netty-codec-http contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to...
CVE-2026-100656
Removed by vendor...
CVE-2026-100656
...
CVE-2026-100656
The Netty library (io.netty:netty-codec-http ) contains an unbounded per-connection queue growth flaw in HttpServerCodec . The component tracks HTTP methods of unanswered pipelined requests; while the first 32 entries are bit-packed, additional entries are appended to an ArrayDeque (methodOverflo...
CVE-2026-100655
Removed by vendor...
CVE-2026-100655
A flaw in Netty (specifically io.netty:netty-codec-http) allows a remote attacker to cause a Denial of Service (DoS) by exhausting server memory. The SpdySessionHandler defaults the localConcurrentStreams limit to Integer.MAX_VALUE without providing an API to restrict it. An attacker can open a S...
EUVD-2026-87749
Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...
CVE-2026-100655
...
CVE-2026-100655 Netty before 4.1.138.Final Denial of Service via SpdySessionHandler
Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...
CVE-2026-100660: Allocation of Resources Without Limits or Throttling
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...
CVE-2026-100663: Improper Input Validation
Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...
CVE-2026-100662: Uncontrolled Resource Consumption
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...
CVE-2026-100659: Inconsistent Interpretation of HTTP Requests
Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...
PT-2026-99333
Name of the Vulnerable Software and Affected Versions Netty HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final Description An uncontrolled resource consumption issue exists in the QPACK encoder-stream instruction decoder within the QpackEncoderHandler installed on the peer-initiated...
CVE-2026-100661: Uncontrolled Resource Consumption
Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...