ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +43381 more potentially affected by CVE-2026-42584 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.132.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +4669 more potentially affected by CVE-2026-42584 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-42584 Source advisory: MEND:CVE-2026-42584...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +1601 more potentially affected by CVE-2026-42582 via io.netty:netty-codec-http3 (>=4.2.2.final, <=4.2.12.final)

io.netty:netty-codec-http3 MAVEN version =4.2.2.final, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-42582 Source advisory: MEND:CVE-2026-42582...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.covia:covia-sql (0.6.0) +3377 more potentially affected by CVE-2026-42579 via io.netty:netty-codec-dns (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-dns MAVEN version =4.2.0.alpha1, =0.4.0, =0.4.0, =1.0.0-beta, =0.6.4, =0.6.4, =0.6.4, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-42579 Source advisory: MEND:CVE-2026-42579...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +4669 more potentially affected by CVE-2026-42581 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-42581 Source advisory: MEND:CVE-2026-42581...

Security Bulletin: DevOps Test Performance contains a vulnerability related to use of netty-codec-http

Summary Due to use of netty-codec-http, DevOps Test Performance and Rational Performance Tester contain a potential CRLF injection vulnerability. Vulnerability Details CVEID:CVE-2026-41417 DESCRIPTION: Netty allows request-line validation to be bypassed when a DefaultHttpRequest or...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of size limits applied to the Properties section during the decoding process. An attacker can cause excessive CPU and memory consumption by sending MQTT messages with...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +820 more potentially affected by CVE-2026-44248 via io.netty:netty-codec-mqtt (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-mqtt MAVEN version =4.2.0.alpha1, =4.2.12.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-mqtt and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +820 more potentially affected by CVE-2026-44248 via io.netty:netty-codec-mqtt (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-mqtt MAVEN version =4.2.0.alpha1, =4.2.12.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-mqtt and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4876 more potentially affected by CVE-2026-44248 via io.netty:netty-codec-mqtt (>=4.1.5.final, <=4.1.132.final)

io.netty:netty-codec-mqtt MAVEN version =4.1.5.final, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.2, =0.0.2, =0.0.2, =0.3.0 and more Source cves:...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +34445 more potentially affected by CVE-2026-42587 via io.netty:netty-codec-http2 (>=4.1.0.beta4, <=4.1.132.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.beta4, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +5615 more potentially affected by CVE-2026-42587 via io.netty:netty-codec-compression (>=4.2.0.alpha3, <=4.2.12.final)

io.netty:netty-codec-compression MAVEN version =4.2.0.alpha3, =0.4.0, =0.4.0, =0.1.0, =0.1.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.3 and more Source cves: CVE-2026-42587 Source advisory: SNYK:JAVA-IONETTY-16438931...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview io.netty:netty-codec is an event-driven asynchronous network application framework. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the HttpContentDecompressor and DelegatingDecompressorFrameListener components when th...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the HttpContentDecompressor and DelegatingDecompressorFrameListener components when the Content-Encoding header is set to br, zstd, or snappy. An attacker can exhaust...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), ai.chronon:service_2.11 (>=def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, <=0.0.115) +4652 more potentially affected by CVE-2026-42586 via io.netty:netty-codec-redis (>=4.1.0.final, <=4.1.132.final)

io.netty:netty-codec-redis MAVEN version =4.1.0.final, =0.0.1, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =3.30.1.1, =3.10.0.5, =0.2.3.5, =0.0.1, =5.1.0, =2.0.21, =2.0.28 and more Source cve...

ai.spice:spiceai (0.6.0), ch.zzeekk.spark:spark-temporalquery_2.13 (4.0.0) +804 more potentially affected by CVE-2026-42586 via io.netty:netty-codec-redis (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-redis MAVEN version =4.2.0.alpha1, =4.2.12.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty-codec-redis and may be impacted: - ai.spice:spiceai 0.6.0 - ch.zzeekk.spark:spark-temporalquery2.13 4.0.0 -...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +43381 more potentially affected by CVE-2026-42585 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.132.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +4669 more potentially affected by CVE-2026-42585 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-42585 Source advisory: SNYK:JAVA-IONETTY-16438737...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.new-wave:spring-agent-app (>=0.1.0, <=0.3.0) +4669 more potentially affected by CVE-2026-42585 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.12.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.5.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-42585 Source advisory: GHSA-38F8-5428-X5CV...

ai.catboost:catboost-spark_4.0_2.13 (1.2.10), ai.catboost:catboost-spark_4.1_2.13 (1.2.10) +5615 more potentially affected by CVE-2026-42583 via io.netty:netty-codec-compression (>=4.2.0.alpha3, <=4.2.12.final)

io.netty:netty-codec-compression MAVEN version =4.2.0.alpha3, =0.4.0, =0.4.0, =0.1.0, =0.1.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.3 and more Source cves: CVE-2026-42583 Source advisory: OSV:GHSA-MJ4R-2HFC-F8P6...