DeutschShown in its original language — a full translation is planned for a future version.
Netty: Mehrere Schwachstellen
view advisory published 2026-06-07
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.
01
describes (21)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-50560US | medium5.3 | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling pr… | ||||
| CVE-2026-50020US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `… | ||||
| CVE-2026-50010US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrust… | ||||
| CVE-2026-50009US | —OT elevated | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network… | ||||
| CVE-2026-48748US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vul… | ||||
| CVE-2026-48059US | high7.5 | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in n… | ||||
| CVE-2026-48043US | high7.5 | — | ||
Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDeco… | ||||
| CVE-2026-48006US | high7.5 | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permane… | ||||
| CVE-2026-47691US | critical10.0OT elevated | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficient… | ||||
| CVE-2026-47244US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint i… | ||||
| CVE-2026-46340US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-… | ||||
| CVE-2026-45674US | critical10.0OT high | Exploit | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to valid… | ||||
| CVE-2026-45673US | —OT elevated | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable… | ||||
| CVE-2026-45536US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_contro… | ||||
| CVE-2026-45416US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the… | ||||
| CVE-2026-44894US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior t… | ||||
| CVE-2026-44893US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a P… | ||||
| CVE-2026-44892US | —OT elevated | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` i… | ||||
| CVE-2026-44890US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cau… | ||||
| CVE-2026-44250US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cau… | ||||
showing 20 of 21
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:26017 vom 2026-06-17external
- Red Hat Security Advisory RHSA-2026:26018 vom 2026-06-17external
- Red Hat Security Advisory RHSA-2026:26586 vom 2026-06-18external
- Red Hat Security Advisory RHSA-2026:28573 vom 2026-06-24external
- Red Hat Security Advisory RHSA-2026:34608 vom 2026-07-02external
- Red Hat Security Advisory RHSA-2026:36820 vom 2026-07-08external
- Red Hat Security Advisory RHSA-2026:37390 vom 2026-07-09external
- Red Hat Security Advisory RHSA-2026:41951 vom 2026-07-20external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan