DeutschShown in its original language — a full translation is planned for a future version.
Netty: Mehrere Schwachstellen
view advisory published 2026-09-09
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Denial-of-Service-Zustände zu verursachen, Sicherheitsmaßnahmen zu umgehen, Request- oder Response-Smuggling durchzuführen sowie Daten offenzulegen oder zu manipulieren.
01
describes (12)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-100665US | high7.5 | — | ||
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager.… | ||||
| CVE-2026-100664US | high7.5 | — | ||
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considerin… | ||||
| CVE-2026-100663US | high7.5 | — | ||
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 m… | ||||
| CVE-2026-100662US | high7.5 | — | ||
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream i… | ||||
| CVE-2026-100661US | high7.5 | — | ||
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUt… | ||||
| CVE-2026-100660US | high7.5 | — | ||
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-… | ||||
| CVE-2026-100659US | medium6.5 | — | ||
Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and… | ||||
| CVE-2026-100658US | medium5.3 | — | ||
Rejected reason: This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-100657US | high7.5 | — | ||
Rejected reason: This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-100656US | high7.5 | — | ||
Rejected reason: This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-100655US | high7.5 | — | ||
Rejected reason: This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-89044US | medium6.5 | — | ||
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowi… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:83612 vom 2026-10-15external
- Netty Security Advisories vom 2026-09-09external
- GitHub Security Advisory GHSA-2g37-3h88-55hc vom 2026-09-09external
- GitHub Security Advisory GHSA-45h4-vhwh-fmhg vom 2026-09-09external
- GitHub Security Advisory GHSA-495p-pchh-r4mc vom 2026-09-09external
- GitHub Security Advisory GHSA-5vh9-c45f-rf7p vom 2026-09-09external
- GitHub Security Advisory GHSA-8352-h356-c9qh vom 2026-09-09external
- GitHub Security Advisory GHSA-8whp-c7w8-2m72 vom 2026-09-09external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan