UBUNTU-CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

CVE-2026-93563

CVE-2026-93563 affects Netty's netty-codec-smtp component, specifically the SmtpResponseDecoder class. The root cause is unbounded multi-line response accumulation , which allows a remote attacker to trigger a memory-exhaustion denial of service over the network without authentication or user int...

ai.spice:spiceai (0.6.0), ch.nolix:nolix (0.0.0) +934 more potentially affected by CVE-2026-93563 via io.netty:netty-codec-smtp (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-smtp MAVEN version =4.2.0.final, =4.2.17.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-smtp and may be impacted: - ai.spice:spiceai 0.6.0 - ch.nolix:nolix 0.0.0 - ch.zzeekk.spark:spark-temporalquery2.13...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4644 more potentially affected by CVE-2026-93563 via io.netty:netty-codec-smtp (>=4.1.8.final, <=4.1.137.final)

io.netty:netty-codec-smtp MAVEN version =4.1.8.final, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source cves...

com.aliyun.odps:hadoop-fs-oss (>=3.3.2-public, <=3.3.8-public), com.aliyun.odps:hadoop-yarn-client (lxw-test-3.0.0-public) +87 more potentially affected by CVE-2026-93572 via io.netty:netty-codec-redis (>=4.1.135.final, <=4.1.137.final)

io.netty:netty-codec-redis MAVEN version =4.1.135.final, =3.3.2-public, =0.58.1-public, =0.58.1-public, =3.9.5, =0.58.1-public, =0.58.1-public, =0.58.1-public, =0.58.1-public, =0.58.1-public, =0.58.1-public, =0.58.1-public, =0.58.1-public, =0.58.1-public, =0.61.2-public -...

CVE-2026-93572

CVE-2026-93572 affects RedisArrayAggregator in io.netty/netty-codec-redis . The component checks maxElements and maxNestedArrayDepth limits independently, but the allocator remains eager: every nested RESP array header creates new ArrayList(length) before any child element exists. With the defaul...

ch.nolix:nolix (0.0.0), cn.managame:game-dev (1.0.0) +350 more potentially affected by CVE-2026-93572 via io.netty:netty-codec-redis (>=4.2.15.final, <=4.2.17.final)

io.netty:netty-codec-redis MAVEN version =4.2.15.final, =1.0.0, =1.0.0, =3.7.0, =26.7.1, =26.8.1, =26.7.1, =0.3.1, =4.4.0, =4.4.2 and more Source cves: CVE-2026-93572 Source advisory: MEND:CVE-2026-93572...

CVE-2026-93575 Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4882 more potentially affected by CVE-2026-93575 via io.netty:netty-codec-mqtt (>=4.1.5.final, <=4.1.137.final)

io.netty:netty-codec-mqtt MAVEN version =4.1.5.final, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.2, =0.0.2, =0.0.2, =0.3.0 and more Source cves:...

CVE-2026-93575 Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits...

ai.spice:spiceai (0.6.0), ch.nolix:nolix (0.0.0) +954 more potentially affected by CVE-2026-93575 via io.netty:netty-codec-mqtt (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-mqtt MAVEN version =4.2.0.final, =4.2.17.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-mqtt and may be impacted: - ai.spice:spiceai 0.6.0 - ch.nolix:nolix 0.0.0 - ch.zzeekk.spark:spark-temporalquery2.13...

EUVD-2026-82864

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

CVE-2026-93561

This vulnerability affects the netty-codec-memcache component of the Netty project. A signed/unsigned type mismatch in the Memcache binary codec can cause frame desynchronization , potentially enabling response smuggling . Red Hat rates it CVSS 6.5 (Medium) — network-exploitable with low complexi...

CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads "keyLength" and "extrasLength" as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

ai.spice:spiceai (0.6.0), ch.nolix:nolix (0.0.0) +932 more potentially affected by CVE-2026-93561 via io.netty:netty-codec-memcache (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-memcache MAVEN version =4.2.0.final, =4.2.17.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-memcache and may be impacted: - ai.spice:spiceai 0.6.0 - ch.nolix:nolix 0.0.0 -...

CVE-2026-93561 Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

CVE-2026-93561

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4642 more potentially affected by CVE-2026-93561 via io.netty:netty-codec-memcache (>=4.1.0.beta1, <=4.1.137.final)

io.netty:netty-codec-memcache MAVEN version =4.1.0.beta1, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source...

CVE-2026-93561 Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling

A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads keyLength and extrasLength as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted...