DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Netty: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-07-14
Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsprüfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen.
01
beschreibt (17)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-59898US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or… | ||||
| CVE-2026-59920US | — | — | ||
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not e… | ||||
| CVE-2026-59901US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipe… | ||||
| CVE-2026-59900US | medium5.3 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFr… | ||||
| CVE-2026-59899US | high7.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handl… | ||||
| CVE-2026-56822US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshake… | ||||
| CVE-2026-56821US | — | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP… | ||||
| CVE-2026-59921US | medium6.5 | — | ||
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bod… | ||||
| CVE-2026-56820US | critical9.1 | — | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does… | ||||
| CVE-2026-56819US | — | Exploit | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remo… | ||||
| CVE-2026-56817US | critical9.8 | — | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any ca… | ||||
| CVE-2026-56816US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved… | ||||
| CVE-2026-56745US | high7.5 | — | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `S… | ||||
| CVE-2026-55851US | high7.5 | — | ||
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but… | ||||
| CVE-2026-55833US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zl… | ||||
| CVE-2026-55831US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-decl… | ||||
| CVE-2026-44891US | — | — | ||
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:47172 vom 2026-07-30external
- Red Hat Security Advisory RHSA-2026:47189 vom 2026-07-29external
- Red Hat Security Advisory RHSA-2026:48118 vom 2026-07-29external
- Red Hat Security Advisory RHSA-2026:54435 vom 2026-08-12external
- Red Hat Security Advisory RHSA-2026:54622 vom 2026-08-13external
- Red Hat Security Advisory RHSA-2026:62260 vom 2026-09-02external
- Red Hat Security Advisory RHSA-2026:66488 vom 2026-09-10external
- Red Hat Security Advisory RHSA-2026:66545 vom 2026-09-11external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan