ROOT-APP-MAVEN-AIKIDO-2026-563243 AIKIDO-2026-563243 in io.netty:netty-codec-classes-quic - Patched by Root

Root has patched AIKIDO-2026-563243 in the io.netty:netty-codec-classes-quic package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-AIKIDO-2026-110281 AIKIDO-2026-110281 in io.netty:netty-codec-http3 - Patched by Root

Root has patched AIKIDO-2026-110281 in the io.netty:netty-codec-http3 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-56745 CVE-2026-56745 in io.netty:netty-codec-http - Patched by Root

Root has patched CVE-2026-56745 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-100659

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority...

Linux Distros Unpatched Vulnerability : CVE-2026-100663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special- case HTTP/1 CONNECT authority-form request-targets when...

Linux Distros Unpatched Vulnerability : CVE-2026-100662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPAC...

Linux Distros Unpatched Vulnerability : CVE-2026-100657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's STOMP codec io.netty:netty-codec-stomp contains a ByteBuf leak in StompSubframeDecoder. Once a frame's declared content-length has been fully read, the...

Linux Distros Unpatched Vulnerability : CVE-2026-100666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +3050 more potentially affected by CVE-2026-100662 via io.netty:netty-codec-http3 (>=4.2.2.final, <=4.2.17.final)

io.netty:netty-codec-http3 MAVEN version =4.2.2.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-100662 Source advisory: SNYK:JAVA-IONETTY-20158603...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Insert With Literal Name handling in QpackEncoderHandler.java, which accepts a declared string-literal length of up to roughly 2 GiB for both the name line 141 and the value li...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +3050 more potentially affected by CVE-2026-100663 via io.netty:netty-codec-http3 (>=4.2.2.final, <=4.2.17.final)

io.netty:netty-codec-http3 MAVEN version =4.2.2.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-100663 Source advisory: SNYK:JAVA-IONETTY-20158598...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +3050 more potentially affected by CVE-2026-100659 via io.netty:netty-codec-http3 (>=4.2.2.final, <=4.2.17.final)

io.netty:netty-codec-http3 MAVEN version =4.2.2.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-100659 Source advisory: SNYK:JAVA-IONETTY-20154842...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in its HTTP/3 request header handling, which does not enforce the RFC 9114 section 4.3.1 requirement that an :authority pseudo-header and a literal host header field carry the same value when both are present. An...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +3050 more potentially affected by CVE-2026-100661 via io.netty:netty-codec-http3 (>=4.2.2.final, <=4.2.17.final)

io.netty:netty-codec-http3 MAVEN version =4.2.2.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-100661 Source advisory: SNYK:JAVA-IONETTY-20154840...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in QpackUtil.decodePrefixedInteger, which places no bound on continuation bytes, unlike the HPACK decoder that stops at shift == 56, so an unterminated run returns -1 for buffer...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +3050 more potentially affected by CVE-2026-100660 via io.netty:netty-codec-http3 (>=4.2.2.final, <=4.2.17.final)

io.netty:netty-codec-http3 MAVEN version =4.2.2.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-100660 Source advisory: SNYK:JAVA-IONETTY-20154839...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the streamSectionTrackers map of QpackEncoder, populated by encodeHeaders, which keeps a queue and dynamic-table index tracker for every encoded field section that references the...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.7) +2315 more potentially affected by CVE-2026-100665 +1 more via io.netty:netty-codec-classes-quic (>=4.2.11.final, <=4.2.17.final)

io.netty:netty-codec-classes-quic MAVEN version =4.2.11.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.8.0, =1.8.0, =4.13.5, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-100665, CVE-2026-50010 Source advisory: SNYK:JAVA-IONETTY-20154418...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +43813 more potentially affected by CVE-2026-100666 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.136.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the isContentAlwaysEmpty method of HttpServerCodec, which calls...