TI-2026-40972 CVE-2026-56819 · GHSA-93wv-jw9v-4972
Uncontrolled resource consumption in netty
Priority HIGH 72
Netty is a network application framework for development of protocol servers and clients.
RHSA-2026:47189
Red Hat build of Quarkus 3.27.4.SP3 security update
Released 2026-07-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Quarkus 3.27.4.SP3 io.netty.netty-codec-haproxy-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.136.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.136.Final-redhat-00001.jar +3
Fixes 13 records
TI-2026-40298 CVE-2026-55831 · GHSA-6jqx-86gh-f27w
Netty SPDY SETTINGS frame count materializes unbounded settings map
Priority HIGH 72
Netty is a network application framework for development of protocol servers and clients.
TI-2026-42729 CVE-2026-59921 · GHSA-gcjf-9mgh-3p7g
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
Priority MEDIUM 62
Netty is an asynchronous, event-driven network application framework.
TI-2026-40918 CVE-2026-56745 · GHSA-jppx-w49h-x2qq
Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Priority MEDIUM 45
Netty is a network application framework for development of protocol servers and clients.
TI-2026-40313 CVE-2026-55851 · GHSA-q6cq-mhr2-jmr5
Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
Priority MEDIUM 45
Netty is a network application framework for development of protocol servers and clients.
TI-2026-40300 CVE-2026-55833 · GHSA-mvh2-crg5-v77c
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
Priority MEDIUM 40
Netty is a network application framework for development of protocol servers and clients.
TI-2026-13631 CVE-2026-16308 · GHSA-g8rv-gp9f-q875
IBM Enterprise Build of Quarkus is affected by a DoS vulnerability
Priority MEDIUM 40
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header…
TI-2026-42714 CVE-2026-59900 · GHSA-c69g-56f8-xwqj
Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
Priority LOW 37
Netty is an asynchronous, event-driven network application framework.
TI-2026-42713 CVE-2026-59899 · GHSA-q4f6-jm68-57ww
Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
Priority LOW 37
Netty is an asynchronous, event-driven network application framework.
TI-2026-12691 CVE-2026-15076 · GHSA-vjx2-fp9g-q2mc
Origin validation error in Eclipse Vert.x
Priority LOW 35
In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does not validate that the Domain attribute of a Set-Cookie response header matches…
TI-2026-12690 CVE-2026-15075
Information disclosure in Eclipse Vert.x
Priority LOW 35
In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all request headers as-is across cross-origin HTTP 30x redirects.
TI-2026-40919 CVE-2026-56746 · GHSA-6cqp-g7gg-8hr5
Netty has a Security Control Bypass via CORS Short-Circuit Failure
Priority LOW 29
Netty is a network application framework for development of protocol servers and clients.
TI-2026-42712 CVE-2026-59898 · GHSA-4mp9-239f-g9hg
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
Priority LOW 28
Netty is an asynchronous, event-driven network application framework.