{"kind": "product", "path": "vulns/ubuntu-26.10/netty", "name": "netty", "product": "netty", "ecosystem": "Ubuntu:26.10", "items": [{"id": "CVE-2026-100666", "noindex": false, "published": "2026-09-26T13:23:31.961Z", "modified": "2026-09-30T14:54:46.509Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00294, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100666", "title": "Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec", "description": "Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connec", "references": ["https://github.com/netty/netty/security/advisories/GHSA-2g6j-r8q9-5hr8", "https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.17-response-desynchronization-via-httpservercodec", "https://nvd.nist.gov/vuln/detail/CVE-2026-100666"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-100665", "noindex": false, "published": "2026-09-26T13:23:31.242Z", "modified": "2026-10-02T15:46:37.467Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00367, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100665", "title": "Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass", "description": "Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.", "references": ["https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387", "https://github.com/netty/netty/commit/09e72c4fd8007277121ed48db63a124b112b96fe", "https://github.com/netty/netty/commit/994e887ed9"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-100664", "noindex": false, "published": "2026-09-26T13:23:30.478Z", "modified": "2026-09-28T16:47:05.471Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100664", "title": "Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion", "description": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3Headers(HttpMessage, boolean) — reached via Http3FrameToHttpObjectCodec(false) — a non-empty Host header takes precedence over the request-target authority, contrary to the HTTP/1.1 rule that a server receiving an absolute-form request-target must ignore the Host header. In a Netty-based HTTP/1-to-HTTP/3 gateway, proxy, or protocol bridge, a remote client can send a request such ", "references": ["https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h", "https://www.vulncheck.com/advisories/netty-4.2.2-through-4.2.15-http-1-host-header-authority-confusion", "https://nvd.nist.gov/vuln/detail/CVE-2026-100664"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-100663", "noindex": false, "published": "2026-09-26T13:23:29.751Z", "modified": "2026-09-28T18:48:51.788Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00301, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100663", "title": "Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3", "description": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target (e.g., \"CONNECT trusted.example:443\") is parsed as a URI, so its host is emitted as :scheme, :path is set to \"/\", and the HTTP/1 Host header is used as :authority; if no Host header is present the CONNECT target is dropped. In a Netty-based HTTP/1-to-HTTP/3 proxy or gateway, a remote client can send a CONNECT request whose Host header names a different authority than the request-target", "references": ["https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627", "https://www.vulncheck.com/advisories/netty-http-1-connect-authority-form-mistranslated-to-malformed-http-3", "https://nvd.nist.gov/vuln/detail/CVE-2026-100663"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-100662", "noindex": false, "published": "2026-09-26T13:23:28.990Z", "modified": "2026-09-30T14:53:30.335Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00416, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100662", "title": "Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS", "description": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the \"Insert With Literal Name\" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFra", "references": ["https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w", "https://www.vulncheck.com/advisories/netty-http-3-qpack-encoder-stream-unbounded-memory-exhaustion-dos", "https://nvd.nist.gov/vuln/detail/CVE-2026-100662"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-100661", "noindex": false, "published": "2026-09-26T13:23:28.303Z", "modified": "2026-10-02T20:46:26.627Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00344, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100661", "title": "Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation", "description": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder c", "references": ["https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx", "https://www.vulncheck.com/advisories/netty-http-3-qpack-prefixed-integer-dos-via-unbounded-accumulation", "https://nvd.nist.gov/vuln/detail/CVE-2026-100661"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-100660", "noindex": false, "published": "2026-09-26T13:23:27.554Z", "modified": "2026-09-28T16:45:45.821Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00454, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100660", "title": "Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention", "description": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed by the peer-controlled QUIC stream ID, and these entries are released only when the remote decoder sends a Section Acknowledgment or Stream Cancellation instruction — not when the HTTP/3 stream completes. There is no limit on the number of tracked streams, field sections, or retained bytes. A remote, unauthenticated HTTP/3 client can advertise a non-zero QPACK dynamic-", "references": ["https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc", "https://www.vulncheck.com/advisories/netty-before-4.2.18-final-qpackencoder-unbounded-memory-retention", "https://nvd.nist.gov/vuln/detail/CVE-2026-100660"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-100659", "noindex": false, "published": "2026-09-26T13:23:26.859Z", "modified": "2026-09-28T18:17:29.170Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00236, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-100659", "title": "Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass", "description": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single HEADERS frame containing both fields with differing, attacker-controlled values; the request is accepted and delivered to the application with two conflicting authorities, allowing routing, virtual-host, and access-control decisions to be bypassed when different components in the request path consult different fields. This issue is fixed in 4.2.18.F", "references": ["https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm", "https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.18-http-3-request-routing-bypass", "https://nvd.nist.gov/vuln/detail/CVE-2026-100659"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93562", "noindex": false, "published": "2026-09-18T20:12:51.910Z", "modified": "2026-10-15T17:01:19.905Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.0041, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93562", "title": "Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling", "description": "A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:83612"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93574", "noindex": false, "published": "2026-09-18T20:12:43.146Z", "modified": "2026-10-15T17:01:26.141Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.01354, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93574", "title": "Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing", "description": "A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:83612"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93579", "noindex": false, "published": "2026-09-18T16:38:29.480Z", "modified": "2026-10-16T17:35:04.052Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00896, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93579", "title": "Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)", "description": "A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:83612"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93573", "noindex": false, "published": "2026-09-18T14:44:00.077Z", "modified": "2026-10-15T17:01:20.443Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00896, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93573", "title": "Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling", "description": "A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:83612"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93568", "noindex": false, "published": "2026-09-18T14:34:04.546Z", "modified": "2026-10-19T10:37:24.899Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00955, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93568", "title": "Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests", "description": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:70257"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93576", "noindex": false, "published": "2026-09-18T14:33:20.473Z", "modified": "2026-09-25T08:29:13.508Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.0027, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93576", "title": "Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)", "description": "A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.", "references": ["https://access.redhat.com/security/cve/CVE-2026-93576", "https://bugzilla.redhat.com/show_bug.cgi?id=2536968", "https://nvd.nist.gov/vuln/detail/CVE-2026-93576"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93569", "noindex": false, "published": "2026-09-18T14:27:54.015Z", "modified": "2026-10-19T10:37:38.533Z", "cvss": 8.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "severity": "high", "epss": 0.02192, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93569", "title": "Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority", "description": "A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:70257"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93567", "noindex": false, "published": "2026-09-18T14:23:27.219Z", "modified": "2026-10-19T10:37:18.171Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.02559, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93567", "title": "Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority", "description": "A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:70257"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93566", "noindex": false, "published": "2026-09-18T14:19:29.741Z", "modified": "2026-10-15T17:01:19.077Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00479, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93566", "title": "Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line", "description": "A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:83612"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93565", "noindex": false, "published": "2026-09-18T14:18:11.431Z", "modified": "2026-10-15T16:42:40.628Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00767, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93565", "title": "Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte", "description": "A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:70257"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93564", "noindex": false, "published": "2026-09-18T14:13:32.128Z", "modified": "2026-10-15T16:42:37.896Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00939, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93564", "title": "Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)", "description": "A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:70257"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}, {"id": "CVE-2026-93558", "noindex": false, "published": "2026-09-18T14:09:01.960Z", "modified": "2026-10-15T16:42:33.129Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.01084, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-93558", "title": "Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service", "description": "A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.", "references": ["https://access.redhat.com/errata/RHSA-2026:69440", "https://access.redhat.com/errata/RHSA-2026:69470", "https://access.redhat.com/errata/RHSA-2026:70257"], "fixes": [], "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}]}], "total": 102, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 6, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "netty", "path": "vulns/ubuntu-26.10/netty", "ecosystem": "Ubuntu:26.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 8, "kev": 0}, "lastmod": "2026-10-19T10:37:38.533Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}