TI-2026-30861 CVE-2026-42581 · GHSA-xxqh-mfjm-7mv9
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Priority HIGH 81
Netty is an asynchronous, event-driven network application framework.
RHSA-2026:49700
Red Hat JBoss Enterprise Application Platform 8.1.7 security update
Released 2026-08-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss EAP 8.1 for RHEL 10 eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el10eap, eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.1-1.GA_redhat_00001.1.el10eap, eap8-netty-4.1.135-1.Final_redhat_00001.1.el10eap +17
- Red Hat JBoss EAP 8.1 for RHEL 8 eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el8eap, eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.1-1.GA_redhat_00001.1.el8eap, eap8-jose4j-0.9.6-2.redhat_00002.1.el8eap +19
- Red Hat JBoss EAP 8.1 for RHEL 9 eap8-eap-product-conf-parent-801.7.1-1.GA_redhat_00001.1.el9eap, eap8-eap-product-conf-wildfly-ee-feature-pack-801.7.1-1.GA_redhat_00001.1.el9eap, eap8-jose4j-0.9.6-2.redhat_00002.1.el9eap +19
Fixes 11 records
TI-2026-30864 CVE-2026-42584 · GHSA-57rv-r2g8-2cj3
Netty: HttpClientCodec response desynchronization
Priority HIGH 78
Netty is an asynchronous, event-driven network application framework.
TI-2026-30859 CVE-2026-42579 · GHSA-cm33-6792-r9fm
Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
Priority HIGH 78
Netty is an asynchronous, event-driven network application framework.
TI-2026-30867 CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
TI-2026-30865 CVE-2026-42585 · GHSA-38f8-5428-x5cv
Netty: HTTP Request Smuggling due to malformed Transfer-Encoding
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
TI-2026-30858 CVE-2026-42578 · GHSA-45q3-82m4-75jr
Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
Priority MEDIUM 48
Netty is an asynchronous, event-driven network application framework.
TI-2026-35195 CVE-2026-47691 · GHSA-5pvg-856g-cp85
Netty has Insufficient Bailiwick Validation for NS Records
Priority MEDIUM 43
Netty is a network application framework for development of protocol servers and clients.
TI-2026-33416 CVE-2026-45674 · GHSA-676x-f7gg-47vc
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Priority MEDIUM 43
Netty is a network application framework for development of protocol servers and clients.
TI-2026-33205 CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
Priority MEDIUM 41
Netty is a network application framework for development of protocol servers and clients.
TI-2026-36836 CVE-2026-50010 · GHSA-c653-97m9-rcg9
Netty's wrapping plain trust manager silently disables hostname verification
Priority LOW 39
Netty is a network application framework for development of protocol servers and clients.
TI-2026-32226 CVE-2026-44249 · GHSA-3qp7-7mw8-wx86
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Priority LOW 39
Netty is a network application framework for development of protocol servers and clients.