192 matches found
netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing
A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate...
netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...
netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing
A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate...
Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.19 Update
An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability scoring System CVSS base score, which gives a detailed severity rating, ...
netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...
Linux Distros Unpatched Vulnerability : CVE-2026-100656
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each...
Linux Distros Unpatched Vulnerability : CVE-2026-100655
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent...
CVE-2026-100666
Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...
DEBIAN-CVE-2026-100656
Bulletin has no description...
CVE-2026-100658
Rejected reason: This CVE ID has been rejected as a duplicate...
CVE-2026-100655
Rejected reason: This CVE ID has been rejected as a duplicate...
DEBIAN-CVE-2026-100655
Bulletin has no description...
CVE-2026-100656
Rejected reason: This CVE ID has been rejected as a duplicate...
CVE-2026-100658
The Netty component (io.netty:netty-codec-http ) is vulnerable to a denial-of-service (DoS) attack due to an unbounded per-connection queue in WebSocketServerExtensionHandler . An unauthenticated remote peer can use HTTP/1.1 pipelining to send requests faster than the application produces respons...
EUVD-2026-87752
Netty io.netty:netty-codec-http contains an unbounded per-connection queue in WebSocketServerExtensionHandler. The handler offers an entry to its per-channel validExtensions queue for every inbound HttpRequest, but polls an entry only when the application writes an HttpResponse, and the queue siz...
CVE-2026-100658
Removed by vendor...
CVE-2026-100656
The Netty library (io.netty:netty-codec-http ) contains an unbounded per-connection queue growth flaw in HttpServerCodec . The component tracks HTTP methods of unanswered pipelined requests; while the first 32 entries are bit-packed, additional entries are appended to an ArrayDeque (methodOverflo...
CVE-2026-100656
Removed by vendor...
