CLEANSTART-2026-FP82534 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the strimzi-kafka-operator package. Netty is an asynchronous, event-driven network application framework...

Security Bulletin: IBM Storage Protect Server is affected by an improper domain name validation vulnerability (CVE-2026-42579).

Summary IBM Storage Protect Server uses the netty-codec-dns library in certain components. A vulnerability in netty could allow improper handling of domain names that do not comply with RFC 1035 constraints. An attacker can exploit this through malicious DNS responses or specially crafted...

CVE-2026-89044

A flaw was found in Netty. A remote attacker could exploit improper validation of the Transfer-Encoding header by sending specially crafted HTTP requests. This vulnerability allows for HTTP request smuggling, enabling attackers to bypass security controls and potentially gain unauthorized access ...

CLEANSTART-2026-CQ05064 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the solr package. Netty is an asynchronous, event-driven network application framework...

CLEANSTART-2026-EA97597 Netty (io

Security vulnerability affects the solr package. Netty io...

CLEANSTART-2026-HW50386 Netty is an asynchronous, event-driven network application framework

Security vulnerability affects the solr package. Netty is an asynchronous, event-driven network application framework...

Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Netty vulnerabilities (USN-8654-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8654-1 advisory. It was discovered that Netty did not properly handle malformed HTTP/2 control frames. An attacker could use this to...

Uncontrolled Resource Consumption

netty-incubator-codec-bhttp is vulnerable to Uncontrolled Resource Consumption . The vulnerability is due to improper termination and lack of forward-progress validation in the BinaryHttpParser field-section decoding loop, which allows an unauthenticated attacker to send a crafted Binary HTTP...

Security Bulletin:Vulnerabilities exists in Netty package used by IBM Netezza Appliance

Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-59902 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final,...

Security Bulletin:Netty Unbounded File Descriptor Leak in Domain Socket Receives

Summary Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, nettyunixsocketrecvFd sets msgcontrol to char controlCMSGSPACEsizeofint line 940 — 24 bytes on 64-bit Linux. A peer-sent SCMRIGHTS cmsg carrying two...

Security Bulletin:Netty Vulnerability in Lz4FrameDecoder: Memory Allocation Bypass

Summary Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength up to 32 MB per block before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22...

CVE-2026-107938

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

EUVD-2026-95703

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

CVE-2026-107938

The Apache CXF Netty-based HTTP client transport (cxf-rt-transports-http-netty-client ) fails to verify that the hostname in a server's TLS certificate matches the host being called. This flaw impacts both HTTP/1.1 and HTTP/2 protocols, even when the disableCNCheck parameter is set to its default...

org.apache.cxf.systests:cxf-systests-transport-netty (>=3.5.7, <=3.6.3), org.apache.cxf:apache-cxf (>=3.0.0, <=3.6.12) +1 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=3.0.0, <=3.6.12)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =3.0.0, =3.5.7, =3.0.0, =3.0.0, =3.6.12 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

kr.jclab.wsman:abstract-wsman (>=0.0.1-rc2, <=0.0.1-rc4), kr.jclab.wsman:abstract-wsman-netty (>=0.0.2-rc1, <=0.0.4) +3 more potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.0.0, <=4.1.8)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.0.0, =0.0.1-rc2, =0.0.2-rc1, =4.0.2, =4.0.0, =4.0.0, =4.1.8 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

org.apache.cxf:apache-cxf (>=4.2.0, <=4.2.3), org.apache.cxf:cxf-distribution-manifest (>=4.2.0, <=4.2.3) potentially affected by CVE-2026-107938 via org.apache.cxf:cxf-rt-transports-http-netty-client (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-transports-http-netty-client MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.3 Source cves: CVE-2026-107938 Source advisory: MEND:CVE-2026-107938...

CVE-2026-107938 Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...

PT-2026-108812

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description The Netty-based HTTP client transport cxf-rt-transports-http-netty-client fails to verify that the hostname in the server TLS...

CVE-2026-107938: Improper Validation of Certificate with Host Mismatch

In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The...