RHSA-2026:66488

Netty is an asynchronous, event-driven network application framework.

node-tar is a tar archive manipulation library for Node.js.

Netty is an asynchronous, event-driven network application framework.

The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete.

node-tar is a tar archive manipulation library for Node.js.

form-data is a library for creating readable multipart/form-data streams.

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

js-yaml is a JavaScript YAML parser and dumper.

Netty is a network application framework for development of protocol servers and clients.

Netty is a network application framework for development of protocol servers and clients.

ws is an open source WebSocket client and server for Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Axios is a promise based HTTP client for the browser and Node.js.

Netty is an asynchronous, event-driven network application framework.

Netty is an asynchronous, event-driven network application framework.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Axios is a promise based HTTP client for the browser and Node.js.

ws is an open source WebSocket client and server for Node.js.

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript.

An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session.

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake.

Netty is an asynchronous, event-driven network application framework.

A remote attacker can craft an Openwire RemoveSubscriptionInfo command to cause the deletion of a queue on the Artemis broker before the connection authentication and authorization stage or at any time thereafter.

Netty is a network application framework for development of protocol servers and clients.

Netty is a network application framework for development of protocol servers and clients.

Netty is a network application framework for development of protocol servers and clients.

pgjdbc is an open source postgresql JDBC Driver.

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509Tr…

: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

Netty is a network application framework for development of protocol servers and clients.

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service.

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.

A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service.

Netty is a network application framework for development of protocol servers and clients.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor.

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All.

Improper Input Validation vulnerability in Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp.

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication.

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service.

Netty is a network application framework for development of protocol servers and clients.

Netty is a network application framework for development of protocol servers and clients.

Netty is an asynchronous, event-driven network application framework.

In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition.

In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition.

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

brace-expansion through 5.0.6 is vulnerable to denial of service.

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments.

Netty is a network application framework for development of protocol servers and clients.

Netty is a network application framework for development of protocol servers and clients.

Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w…

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames…

Netty is an asynchronous, event-driven network application framework.

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc.

Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc.

When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform management-via-messaging, the parameter processing can trigg…

Uncontrolled Recursion vulnerability in Apache Commons.

Netty is a network application framework for development of protocol servers and clients.

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-p…

Impact: When a user-configured proxy on webpack-dev-server has a broad context (e.g.