PT-2026-99328

Name of the Vulnerable Software and Affected Versions Netty STOMP codec versions prior to 4.1.138.Final Netty STOMP codec versions 4.2.0.Final through 4.2.17.Final Description A ByteBuf leak exists in the StompSubframeDecoder function. When a frame's declared content-length is fully read, the...

PT-2026-99330

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final Description The HTTP/3 codec fails to enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field must carry the same value when both are...

PT-2026-99332

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final Description A denial-of-service issue exists in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger that fails to bound the number of continuation bytes processed. A...

PT-2026-99331

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final Description The HTTP/3 codec retains unbounded per-stream QPACK encoder state. The QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that...

PT-2026-99334

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final Description The HTTP/3 codec fails to properly handle HTTP/1 CONNECT authority-form request-targets during the conversion of HTTP/1 messages to HTTP/3 within the toHttp3Headers functi...

PT-2026-99327

Name of the Vulnerable Software and Affected Versions Netty io.netty:netty-codec-http versions 4.2.0.Final through 4.2.17.Final Netty io.netty:netty-codec-http versions prior to 4.1.138.Final Description An unbounded per-connection queue growth flaw exists in the HttpServerCodec. The codec tracks...

PT-2026-99329

Name of the Vulnerable Software and Affected Versions Netty io.netty:netty-codec-http versions 4.1.88.Final through 4.1.137.Final Netty io.netty:netty-codec-http versions 4.2.0.Final through 4.2.17.Final Description An unbounded per-connection queue exists in the WebSocketServerExtensionHandler...

PT-2026-99335

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final Description The HTTP/3 codec incorrectly builds the :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. Th...

CVE-2026-100660: Allocation of Resources Without Limits or Throttling

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controll...

io.netty/netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder

A flaw was found in Netty's XmlFrameDecoder component. An unauthenticated remote attacker could send specially crafted XML closing-tag sequences. This could cause the system to repeatedly rescan accumulated data, leading to high CPU utilization and a denial of service DoS...

Important: Red Hat Security Advisory: qt5-qtbase security update

An update for qt5-qtbase is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

SUSE CVE-2026-93567

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

SUSE CVE-2026-93574

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...

SUSE CVE-2026-93576

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

Important: Red Hat Security Advisory: qt5-qtbase security update

An update for qt5-qtbase is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Important: Red Hat Security Advisory: qt5-qtbase security update

An update for qt5-qtbase is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

PT-2026-97566

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.2.7 RabbitMQ versions prior to 4.3.1 Description An authenticated AMQP 0-9-1 client can crash the Erlang VM, affecting all vhosts and connections, by sending approximately 1 million requests. The issue occurs when...

RHEL 9 : qt5-qtbase (RHSA-2026:70562)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70562 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security...

RHEL 9 : qt5-qtbase (RHSA-2026:70560)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70560 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security...

RHEL 9 : qt5-qtbase (RHSA-2026:70561)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:70561 advisory. Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security...