| netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionCVE-2026-48043 · GHSA-C2GF-V879-257J |
io.netty:netty-codec-http2OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header OverwriteCVE-2026-59903 · GHSA-8C42-7QJ2-3J46 |
io.netty:netty-codec-httpExploit Intelligence/exploit-intelligence/agent-client-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)CVE-2026-56819 · GHSA-93WV-JW9V-4972 |
io.netty:netty-codec-http2OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing BypassCVE-2026-59900 · GHSA-C69G-56F8-XWQJ |
io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationCVE-2026-59898 · GHSA-4MP9-239F-G9HG |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: Security Control Bypass via CORS Short-Circuit FailureCVE-2026-56746 · GHSA-6CQP-G7GG-8HR5 |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty SPDY SETTINGS frame count materializes unbounded settings mapCVE-2026-55831 · GHSA-6JQX-86GH-F27W |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source PortCVE-2026-45673 · GHSA-XMV7-R254-6Q78 |
io.netty:netty-resolver-dnsCryostat 4/netty-resolver-dns |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationCVE-2026-42581 · GHSA-XXQH-MFJM-7MV9 |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsingCVE-2026-42580 · GHSA-M4CV-J2PX-7723 |
io.netty:netty-codec-httpCryostat 4/netty-codec-http2 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)CVE-2026-42579 · GHSA-CM33-6792-R9FM |
io.netty:netty-codec-dnsOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| Netty has HttpClientCodec response desynchronizationCVE-2026-42584 · GHSA-57RV-R2G8-2CJ3 |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)CVE-2026-42578 · GHSA-45Q3-82M4-75JR |
io.netty:netty-handler-proxyOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
Low
|
Fix reported |
|
| Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingCVE-2026-44249 · GHSA-3QP7-7MW8-WX86 |
io.netty:netty-handlerOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serializationCVE-2026-49844 · GHSA-QV9R-C865-CP47 |
org.apache.logging.log4j:log4j-apiCryostat 4/log4j-api |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: Memory Leak in DNS Record Decoder via Malformed Domain NamesCVE-2026-73508 · GHSA-MFG7-5GFP-C4W3 |
io.netty:netty-codec-dnsExploit Intelligence/exploit-intelligence/agent-client-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoderCVE-2026-59921 · GHSA-GCJF-9MGH-3P7G |
io.netty:netty-codec-httpCryostat 4/netty-codec-http |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of ServiceCVE-2026-59899 · GHSA-Q4F6-JM68-57WW |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncationCVE-2026-55833 · GHSA-MVH2-CRG5-V77C |
io.netty:netty-codec-httpOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| Netty epoll transport denial of service via RST on half-closed TCP connectionCVE-2026-42577 · GHSA-RWM7-X88C-3G2P |
io.netty:netty-transport-classes-epollCryostat 4/cryostat/cryostat-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
