{"kind": "product", "path": "vulns/ubuntu-25.10/netty", "name": "netty", "product": "netty", "ecosystem": "Ubuntu:25.10", "items": [{"id": "CVE-2026-50560", "noindex": false, "published": "2026-06-12T14:59:59.901Z", "modified": "2026-06-13T03:21:17.132Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00397, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-50560", "title": "Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follows: read the request; proxy the request to the origin; attempt to produce a response; and create an exception while writing the headers for the response. Functionally, this should be similar to the http2 reset attack, but with a different on-the-wire ", "references": ["https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-50020", "noindex": false, "published": "2026-06-12T14:55:32.165Z", "modified": "2026-06-12T15:56:43.051Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00232, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-50020", "title": "Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance intended to handle HTTP/1.0 POST workarounds. Silently absorbing NUL bytes, SOH, STX, and other non-CRLF control characters goes significantly beyond this, and can be exploited for request-boundary confusion in", "references": ["https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-50011", "noindex": false, "published": "2026-06-12T14:52:18.042Z", "modified": "2026-09-18T12:04:51.521Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00461, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-50011", "title": "Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge initial capacity. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "references": ["https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-50010", "noindex": false, "published": "2026-06-12T14:50:43.151Z", "modified": "2026-09-18T12:04:48.708Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00491, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-50010", "title": "Netty's wrapping plain trust manager silently disables hostname verification", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identif", "references": ["https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-50009", "noindex": false, "published": "2026-06-12T14:47:09.748Z", "modified": "2026-06-12T16:09:20.567Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "severity": "medium", "epss": 0.00204, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-50009", "title": "Netty QUIC stateless reset token material exposed through header-visible connection IDs", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC headers after a source-CID rotation. An on-path attacker observing the headers can use the token to perform a Denial of Service by sending a spoofed Stateless Reset packet. Version 4.2.15.Final patches the issue.", "references": ["https://github.com/netty/netty/security/advisories/GHSA-cq4q-cv5g-r8q5", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "https://nvd.nist.gov/vuln/detail/CVE-2026-50009"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-48748", "noindex": false, "published": "2026-06-12T14:45:04.763Z", "modified": "2026-08-04T21:49:40.894Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00392, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48748", "title": "Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion", "description": "Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue.", "references": ["https://github.com/netty/netty/security/advisories/GHSA-4grm-h2qv-h6w6", "https://github.com/netty/netty/commit/75127cab731ee35068d1f0667bffa188bc332f5d", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-48059", "noindex": false, "published": "2026-06-12T14:42:44.677Z", "modified": "2026-09-18T12:04:39.489Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0063, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48059", "title": "Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated b", "references": ["https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-48043", "noindex": false, "published": "2026-06-12T14:39:52.498Z", "modified": "2026-09-18T12:04:47.039Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00753, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48043", "title": "netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion", "description": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandlerAdapter` tail handler, which becomes the sole owner responsible for releasing it. A remote peer could send frames that would result in the flow-cont", "references": ["https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-48006", "noindex": false, "published": "2026-06-12T14:36:44.416Z", "modified": "2026-09-18T12:04:45.796Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0074, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-48006", "title": "Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelInactive`, `handlerRemoved`, or `exceptionCaught` method to release them when the pipeline tears down. Because the leaked buffers are slices of `PooledByteBufAllocator` chunks, they prevent those chunks from being returned to the JVM-wide direct-memory ", "references": ["https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-47691", "noindex": false, "published": "2026-06-12T14:33:16.595Z", "modified": "2026-09-18T12:04:40.254Z", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00372, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-47691", "title": "Netty has Insufficient Bailiwick Validation for NS Records", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A recor", "references": ["https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-47244", "noindex": false, "published": "2026-06-12T14:23:50.316Z", "modified": "2026-06-12T14:59:15.823Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00384, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-47244", "title": "Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry", "references": ["https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-46340", "noindex": false, "published": "2026-06-12T14:19:48.855Z", "modified": "2026-09-18T12:04:51.463Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00606, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-46340", "title": "Netty: SCTP reassembly nests buffers without bound", "description": "Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays; readableBytes()/getBytes() on the final buffer recurse N levels. There is no limit on N, on total bytes, or on the number of streamIdentifiers an att", "references": ["https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-45674", "noindex": false, "published": "2026-06-12T14:17:50.203Z", "modified": "2026-09-18T12:04:44.108Z", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00292, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45674", "title": "Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "references": ["https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-45673", "noindex": false, "published": "2026-06-12T14:16:03.968Z", "modified": "2026-06-12T16:05:32.064Z", "cvss": 6.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N", "severity": "medium", "epss": 0.0032, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45673", "title": "Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "references": ["https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-45536", "noindex": false, "published": "2026-06-12T14:12:48.126Z", "modified": "2026-06-12T15:05:36.411Z", "cvss": 4, "cvss_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.00136, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45536", "title": "Netty: Unix-socket fd receive leaks descriptors when peer sends two at once", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel installs both fds in the receiving process. The subsequent check `cmsg->cmsg_len == CMSG_LEN(sizeof(int))` (line 972, expected 20) fails, the branch that would read the fd is skipped, and neither installed fd is closed. The for(;;) loop calls recvmsg aga", "references": ["https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-45416", "noindex": false, "published": "2026-06-12T14:10:05.585Z", "modified": "2026-09-18T12:04:45.683Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00921, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-45416", "title": "Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is d", "references": ["https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-44894", "noindex": false, "published": "2026-06-12T14:06:54.213Z", "modified": "2026-07-15T00:53:03.417Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00143, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44894", "title": "Netty's Default QUIC token handler accepts any client-supplied token", "description": "Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from validateToken() is interpreted as 'token is valid, ODCID starts at offset 0', causing the server to call quiche_accept as if the client's address had been validated by a Retry round-trip. Per RFC 9000 §8.1, a validated address lifts the 3× anti-amplificati", "references": ["https://github.com/netty/netty/security/advisories/GHSA-cmm3-54f8-px4j", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "https://access.redhat.com/security/cve/CVE-2026-44894"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-44893", "noindex": false, "published": "2026-06-12T14:00:25.801Z", "modified": "2026-09-18T12:04:39.267Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00617, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44893", "title": "Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length", "description": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Ver", "references": ["https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-44892", "noindex": false, "published": "2026-06-12T05:04:58.033Z", "modified": "2026-06-12T09:59:06.667Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00279, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44892", "title": "Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size", "description": "Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an `OutOfMemoryError`. Version 4.2.15.Final contains a patch.", "references": ["https://github.com/netty/netty/security/advisories/GHSA-c2rx-5r8w-8xr2", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "https://nvd.nist.gov/vuln/detail/CVE-2026-44892"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-44890", "noindex": false, "published": "2026-06-11T20:52:50.980Z", "modified": "2026-09-18T12:04:47.884Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00461, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-44890", "title": "Netty has Unbounded Direct Memory Consumption in its RedisDecoder", "description": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\\r\\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "references": ["https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3", "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}]}], "total": 42, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "netty", "path": "vulns/ubuntu-25.10/netty", "ecosystem": "Ubuntu:25.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-18T12:04:51.521Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}