DeutschShown in its original language — a full translation is planned for a future version.
Netty: Mehrere Schwachstellen
view advisory published 2026-07-14
Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsprüfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen.
01
describes (17)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59898US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or… | ||||
| CVE-2026-59920US | — | — | ||
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not e… | ||||
| CVE-2026-59901US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipe… | ||||
| CVE-2026-59900US | medium5.3 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFr… | ||||
| CVE-2026-59899US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handl… | ||||
| CVE-2026-56822US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshake… | ||||
| CVE-2026-56821US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP… | ||||
| CVE-2026-59921US | medium6.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bod… | ||||
| CVE-2026-56820US | critical9.1 | — | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does… | ||||
| CVE-2026-56819US | — | Exploit | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remo… | ||||
| CVE-2026-56817US | critical9.8 | — | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any ca… | ||||
| CVE-2026-56816US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved… | ||||
| CVE-2026-56745US | high7.5 | — | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `S… | ||||
| CVE-2026-55851US | high7.5 | — | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but… | ||||
| CVE-2026-55833US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zl… | ||||
| CVE-2026-55831US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-decl… | ||||
| CVE-2026-44891US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:47172 vom 2026-07-30external
- Red Hat Security Advisory RHSA-2026:47189 vom 2026-07-29external
- Red Hat Security Advisory RHSA-2026:48118 vom 2026-07-29external
- Red Hat Security Advisory RHSA-2026:54435 vom 2026-08-12external
- Red Hat Security Advisory RHSA-2026:54622 vom 2026-08-13external
- Red Hat Security Advisory RHSA-2026:62260 vom 2026-09-02external
- Red Hat Security Advisory RHSA-2026:66488 vom 2026-09-10external
- Red Hat Security Advisory RHSA-2026:66545 vom 2026-09-11external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan