TI-2026-26231 CVE-2026-33870 · GHSA-pwqr-wmgm-9rr8
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
RHSA-2026:7109
Red Hat build of Quarkus 3.20.6 release and security update
Released 2026-04-14 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat build of Quarkus 3.20.6.redhat io.netty.netty-codec-http-4.1.132.Final-redhat-00001.jar, io.netty.netty-codec-http2-4.1.132.Final-redhat-00001.jar, io.vertx.vertx-core-4.5.26.redhat-00001.jar +2
Fixes 5 records
TI-2026-00756 CVE-2026-1002 · GHSA-cphf-4846-3xx9
Eclipse Vert.x Web static handler file access denial
Priority HIGH 70
The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URI.
TI-2026-26232 CVE-2026-33871 · GHSA-w9fj-cfpg-grvv
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
Priority MEDIUM 46
Netty is an asynchronous, event-driven network application framework.
TI-2025-41106 CVE-2025-67030 · GHSA-6fmv-xxpf-w3cw
Directory Traversal vulnerability in the extractFile method of…
Priority MEDIUM 41
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642.
TI-2025-24035 CVE-2025-33042 · GHSA-rp46-r563-jrc7
Apache Avro Java SDK: Code injection on Java generated code
Priority LOW 39
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas.