DeutschShown in its original language — a full translation is planned for a future version.
Netty: Mehrere Schwachstellen
view advisory published 2026-05-05
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-44248US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before an… | ||||
| CVE-2026-42587US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit de… | ||||
| CVE-2026-42586US | high7.1 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled s… | ||||
| CVE-2026-42585US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling reques… | ||||
| CVE-2026-42584US | critical9.1 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request… | ||||
| CVE-2026-42583US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to… | ||||
| CVE-2026-42582US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.Qpa… | ||||
| CVE-2026-42581US | critical9.8 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a r… | ||||
| CVE-2026-42580US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request sm… | ||||
| CVE-2026-42579US | critical9.1 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints d… | ||||
| CVE-2026-42578US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header… | ||||
| CVE-2026-42577US | — | — | ||
Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that rece… | ||||
| CVE-2026-41417US | — | — | ||
Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constr… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:23808 vom 2026-06-10external
- Red Hat Security Advisory RHSA-2026:24502 vom 2026-06-10external
- Red Hat Security Advisory RHSA-2026:25123 vom 2026-06-11external
- Red Hat Security Advisory RHSA-2026:28010 vom 2026-06-22external
- Red Hat Security Advisory RHSA-2026:34608 vom 2026-07-02external
- Red Hat Security Advisory RHSA-2026:36820 vom 2026-07-08external
- Red Hat Security Advisory RHSA-2026:37390 vom 2026-07-09external
- Red Hat Security Advisory RHSA-2026:41951 vom 2026-07-20external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan