SecurityRAT

OWASP Security RAT Requirement Automation Tool is a tool helping you manage security requirements in your agile development projects. The typical use case is: specify parameters of the software artifact you're developing based on this information, list of common security requirements is generated...

CVE-2025-27591_PoC

Proof-Of-Concept Usage 1. build go build -o poc exploit.go 2. move the binary to the target machine https://github.com/user-attachments/assets/d5e3f8e7-ba05-42f8-a533-21179cd77177 References https://nvd.nist.gov/vuln/detail/CVE-2025-27591 https://access.redhat.com/security/cve/cve-2025-27591...

Uncontrolled Resource Consumption

netty-incubator-codec-bhttp is vulnerable to Uncontrolled Resource Consumption . The vulnerability is due to improper termination and lack of forward-progress validation in the BinaryHttpParser field-section decoding loop, which allows an unauthenticated attacker to send a crafted Binary HTTP...

CLEANSTART-2026-HN92795 Security fix for CVE-2025-49574 applied in: incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kogito-apps 10.1.0-r0

CVE-2025-49574 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-54251

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

EUVD-2026-78879

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

CVE-2026-54251: Improper Control of a Resource Through its Lifetime

netty-incubator-codec-ohttp implements Oblivious HTTP OHTTP gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway decryption path in codec-ohttp/src/main/java/io/netty/incubator/codec/ohttp/OHttpRequestResponseContext.java allocates a pooled direct ByteBuf for...

Denial-of-service (DoS)

io.netty.incubator, netty-incubator-codec-ohttp is vulnerable to a denial-of-service DoS. The vulnerability is due to an allocated direct ByteBuf not being released when AEAD tag verification fails, which allows an attacker to repeatedly send invalid encrypted requests and exhaust native memory,...

Denial Of Service

netty-incubator-codec-ohttp is vulnerable to Denial of Service. The vulnerability is due to the BinaryHttpParser not enforcing limits for encoded variable length fields, where a remote peer controls these lengths and can cause the parser to buffer data indefinitely...

CVE-2026-61799

"io.netty.incubator:netty-incubator-codec-bhttp" uses attacker-controlled Binary HTTP variable-length integers as "long" values but accumulates them into "int" offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked "ArrayIndexOutOfBoundsException" /...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61799 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61799 Source advisory: MEND:CVE-2026-61799...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61827 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61827 Source advisory: MEND:CVE-2026-61827...

CVE-2026-63124

"io.netty.incubator:netty-incubator-codec-bhttp" can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using "BinaryHttpParser" / "BinaryHttpDecoder" can use ...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63124 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63124 Source advisory: MEND:CVE-2026-63124...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63202 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63202 Source advisory: MEND:CVE-2026-63202...

io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.22.final) potentially affected by CVE-2026-61798 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.22.final Source cves: CVE-2026-61798 Source advisory: MEND:CVE-2026-61798...