TI-2026-30861 CVE-2026-42581 · GHSA-xxqh-mfjm-7mv9
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Priority HIGH 81
Netty is an asynchronous, event-driven network application framework.
RHSA-2026:73976
Red Hat JBoss Enterprise Application Platform 7.1.16 security update
Released 2026-09-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-hibernate-5.1.17-5.Final_redhat_00006.1.ep7.el7, eap7-hibernate-core-5.1.17-5.Final_redhat_00006.1.ep7.el7, eap7-hibernate-entitymanager-5.1.17-5.Final_redhat_00006.1.ep7.el7 +7
Fixes 7 records
TI-2026-30864 CVE-2026-42584 · GHSA-57rv-r2g8-2cj3
Netty: HttpClientCodec response desynchronization
Priority HIGH 78
Netty is an asynchronous, event-driven network application framework.
TI-2026-22089 CVE-2026-27727 · GHSA-m2cm-222f-qw44
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
Priority HIGH 74
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downl…
TI-2026-30865 CVE-2026-42585 · GHSA-38f8-5428-x5cv
Netty: HTTP Request Smuggling due to malformed Transfer-Encoding
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
TI-2026-30863 CVE-2026-42583 · GHSA-mj4r-2hfc-f8p6
Netty: Lz4FrameDecoder resource exhaustion
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
TI-2026-30858 CVE-2026-42578 · GHSA-45q3-82m4-75jr
Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
Priority MEDIUM 48
Netty is an asynchronous, event-driven network application framework.
TI-2026-22181 CVE-2026-27830 · GHSA-5476-xc4j-rqcv
c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property
Priority MEDIUM 41
c3p0, a JDBC Connection pooling library, is vulnerable to attack via maliciously crafted Java-serialized objects and `javax.naming.Reference` instances.