ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +2632 more potentially affected by CVE-2026-42587 via io.netty:netty-codec-http2 (>=4.2.0.Alpha1 <=4.2.12.Final)

🗓️ 07 May 2026 00:46:35Reported by Vulners OSVType

vulnersosv

vulnersosv🔗 osv.dev👁 12 Views

io.netty http2 codec vulnerable to CVE-2026-42587, affecting ai.new-wave and ai.tock packages.

Reporter	Title	Published	Views	Family All 187
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains vulnerabilities related to use of netty-codec-http	19 May 202619:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	25 Jun 202617:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is affected by multiple vulnerability in the netty-codec-http library that could allow an attacker to exploit integer overflow conditions when processing chunked HTTP requests(CVE-2026-42581, CVE-2026-42584).	31 Jul 202620:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty	21 May 202616:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	23 Jun 202619:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:27	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Netty, IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	11 Jun 202607:12	–	ibm
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Bamboo Data Center	1 Jun 202622:29	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Crowd Data Center	12 Jun 202611:29	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Jira Service Management Data Center	3 Jun 202616:29	–	atlassian

14 May 2026 20:50Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

EPSS0.0099

SSVC

netty vulnerability http2 codec cve-2026-42587 new wave packages tock packages