TI-2026-30861 CVE-2026-42581 · GHSA-xxqh-mfjm-7mv9
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Priority HIGH 81
Netty is an asynchronous, event-driven network application framework.
RHSA-2026:23808
Red Hat build of Quarkus 3.27.4 release and security update
Released 2026-06-10 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Quarkus 3.27.4.redhat io.netty.netty-codec-dns-4.1.133.Final-redhat-00002.jar, io.netty.netty-codec-http-4.1.133.Final-redhat-00002.jar, io.netty.netty-codec-http2-4.1.133.Final-redhat-00002.jar +1
Fixes 5 records
TI-2026-30864 CVE-2026-42584 · GHSA-57rv-r2g8-2cj3
Netty: HttpClientCodec response desynchronization
Priority HIGH 78
Netty is an asynchronous, event-driven network application framework.
TI-2026-30859 CVE-2026-42579 · GHSA-cm33-6792-r9fm
Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
Priority HIGH 78
Netty is an asynchronous, event-driven network application framework.
TI-2026-30867 CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
TI-2026-30858 CVE-2026-42578 · GHSA-45q3-82m4-75jr
Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
Priority MEDIUM 48
Netty is an asynchronous, event-driven network application framework.