TI-2026-30861 CVE-2026-42581 · GHSA-xxqh-mfjm-7mv9
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Priority HIGH 81
Netty is an asynchronous, event-driven network application framework.
RHSA-2026:28010
Red Hat build of Cryostat security update
Released 2026-06-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Cryostat 4 on RHEL 9 cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9, cryostat/cryostat-rhel9 +3
Fixes 10 records
TI-2026-30864 CVE-2026-42584 · GHSA-57rv-r2g8-2cj3
Netty: HttpClientCodec response desynchronization
Priority HIGH 78
Netty is an asynchronous, event-driven network application framework.
TI-2026-30859 CVE-2026-42579 · GHSA-cm33-6792-r9fm
Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
Priority HIGH 78
Netty is an asynchronous, event-driven network application framework.
TI-2026-30867 CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
TI-2026-29849 CVE-2026-41240 · GHSA-h7mw-gpvr-xq4m
DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
Priority MEDIUM 60
DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.
TI-2026-30858 CVE-2026-42578 · GHSA-45q3-82m4-75jr
Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
Priority MEDIUM 48
Netty is an asynchronous, event-driven network application framework.
TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p
shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`
Priority MEDIUM 43
shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.
TI-2025-30732 CVE-2025-48431 · GHSA-ppv5-592p-g5q4
Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.
Priority MEDIUM 41
Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings.
TI-2026-31933 CVE-2026-43869 · GHSA-7pwc-h2j2-rjgj
Apache Thrift: TSSLTransportFactory.java hostname verification
Priority LOW 39
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.
TI-2026-24810 CVE-2026-32281 · GHSA-gjvh-7jh8-7xhm
Inefficient policy validation in crypto/x509
Priority LOW 39
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.