CVE-2026-59900

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter fails to deduplicate or validate Host headers when an HTTP/2 client...

Exploit for CVE-2026-52134

CVE-2026-52134: GOOSE replay and message-freshness handling in...

CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-59901

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

EUVD-2026-50440

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

CVE-2026-59901

Netty CVE-2026-59901 affects the Bzip2Decoder in the compression codec pipeline. The issue is a flaw in the Bzip2BlockDecompressor.read() RLE state machine that can cause an infinite loop, hanging the event-loop thread and triggering DoS. Fixed in Netty versions 4.1.136.Final and 4.2.16.Final. Af...

CVE-2026-59901

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the Bzip2Decoder handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the...

Important: Red Hat Security Advisory: nodejs-nodemon security update

An update for nodejs-nodemon is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

CVE-2026-59919

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

CVE-2026-59919 Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

CVE-2026-59919 Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

EUVD-2026-50438

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

CVE-2026-59919 Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

CVE-2026-59919

Netty CVE-2026-59919 affects the HAProxy encoder (HAProxyMessageEncoder) in Netty versions prior to 4.1.136.Final and 4.2.16.Final. The encoder writes AF_UNIX source/destination addresses into the HAProxy V1 text protocol without validating for CRLF, allowing an attacker who controls an AF_UNIX a...

CVE-2026-59919

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder HAProxyMessageEncoder writes AFUNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF...

CVE-2026-46681

A flaw was found in the @nevware21/ts-utils library. This vulnerability allows a remote attacker to manipulate the fundamental properties of objects within an application. By exploiting this, an attacker could potentially execute unauthorized code, leading to a complete compromise of the...

CVE-2026-59920 Netty: STOMP CONNECT Frame Header Injection

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder StompSubframeEncoder does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline \n characters in a header value are...

CVE-2026-59920

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder StompSubframeEncoder does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline \n characters in a header value are...