Vulnerabilities Affecting SICK CorivaEngine
SICK CorivaEngine includes the third-party components Netty and Spring Cloud Gateway that are affected by multiple known vulnerabilities. Under certain conditions, these vulnerabilities could allow remote attackers to perform HTTP request smuggling, cause resource exhaustion, or manipulate forwarded request headers. Successful exploitation may impact the integrity and availability of affected systems. SICK has addressed these vulnerabilities and recommends that customers apply the remediations described in this Security Advisory.
describes (3)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-59898US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or… | ||||
| CVE-2026-59899US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handl… | ||||
| CVE-2026-47825US | — | — | ||
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux G… | ||||
references
External citations — patches, advisories, analysis.
remediations (3)
- FixedCorivaEngine
Users are recommended to upgrade to version 2026.1.1.
- FixedCorivaEngine
Users are recommended to upgrade to version 2026.1.1.
- FixedCorivaEngine
Users are recommended to upgrade to version 2026.1.1.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan