Red Hat Security Advisory

RHSA-2026:49701

Red Hat JBoss Enterprise Application Platform 8.1.7 security update

Released 2026-08-03 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 8.1.7.GA io.netty.netty-codec-dns-4.1.135.Final-redhat-00001.jar, io.netty.netty-codec-http-4.1.135.Final-redhat-00001.jar, io.netty.netty-handler-4.1.135.Final-redhat-00001.jar +2

Fixes 11 records

TI-2026-30861 CVE-2026-42581 · GHSA-xxqh-mfjm-7mv9

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

HIGH 81

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0063 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30864 CVE-2026-42584 · GHSA-57rv-r2g8-2cj3

Netty: HttpClientCodec response desynchronization

HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00838 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30859 CVE-2026-42579 · GHSA-cm33-6792-r9fm

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

HIGH 78

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01006 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-20

TI-2026-30867 CVE-2026-42587 · GHSA-f6hv-jmp6-3vwv

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0099 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400

TI-2026-30865 CVE-2026-42585 · GHSA-38f8-5428-x5cv

Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

HIGH 72

Netty is an asynchronous, event-driven network application framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00267 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444

TI-2026-30858 CVE-2026-42578 · GHSA-45q3-82m4-75jr

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

MEDIUM 48

Netty is an asynchronous, event-driven network application framework.

CVSS 4.0LOW 2.9 Network No auth No interaction EPSS 0.01065 Published 2026-05-13 Partial fix · 4.2.13.Final, 4.1.133.Final CWE-113

TI-2026-35195 CVE-2026-47691 · GHSA-5pvg-856g-cp85

Netty has Insufficient Bailiwick Validation for NS Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00372 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2026-33416 CVE-2026-45674 · GHSA-676x-f7gg-47vc

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

MEDIUM 43

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00292 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-345

TI-2026-33205 CVE-2026-45416 · GHSA-x4gw-5cx5-pgmh

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

MEDIUM 41

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00921 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-770

TI-2026-36836 CVE-2026-50010 · GHSA-c653-97m9-rcg9

Netty's wrapping plain trust manager silently disables hostname verification

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00491 Published 2026-06-12 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-347

TI-2026-32226 CVE-2026-44249 · GHSA-3qp7-7mw8-wx86

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

LOW 39

Netty is a network application framework for development of protocol servers and clients.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00987 Published 2026-06-11 Partial fix · 4.2.15.Final, 4.1.135.Final CWE-284