Red Hat Security AdvisoryRHSA-2026:83612
Red Hat build of Debezium 3.6.3 release
Released 2026-10-15 · Red Hat rating Important · View on Red Hat →
Fixes 29 records
Priority HIGH 77
The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00463 · Published 2026-08-04 · Partial fix · 2.18.8, 2.21.4 +1 CWE-770
Priority HIGH 77
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00632 · Published 2026-08-04 · Partial fix · 9.4.63, 10.0.31 +3 CWE-173
Priority HIGH 72
A flaw was found in Netty's WebSocketServerExtensionHandler.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01223 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-1035
Priority HIGH 70
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMetho…
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00294 · Published 2026-09-26 · Partial fix · 4.2.17.Final, 4.1.137.Final CWE-444
Priority HIGH 68
A flaw was found in Netty's HTTP/1 decoder.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00494 · Published 2026-09-18 · Partial fix · 26.4.17-2, 26.4-29 +3 CWE-1035
Priority MEDIUM 47
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00331 · Published 2026-08-11 · Partial fix CWE-295
Priority MEDIUM 46
A flaw was found in Netty.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.02417 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-444
Priority MEDIUM 45
An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms might allow a remote unauthenticated actor to obtain information from adjacent p…
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00539 · Published 2026-09-10 · Partial fix CWE-190
Priority MEDIUM 44
A flaw was found in Netty's HTTP/2 codec.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02885 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-20
Priority MEDIUM 43
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509Tr…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00155 · Published 2026-08-22 · Partial fix · 4.2.16.Final, 4.1.137.Final CWE-297
Priority MEDIUM 41
A flaw was found in Netty.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01077 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-20
Priority MEDIUM 41
A flaw was found in Netty.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01059 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-1035
Priority MEDIUM 41
A flaw was found in Netty's HttpServerCodec.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00881 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-770
Priority MEDIUM 41
A flaw was found in Netty.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00955 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-770
Priority MEDIUM 41
Netty is an asynchronous, event-driven network application framework.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00316 · Published 2026-08-19 · Partial fix · 4.1.137.Final, 4.2.17.Final CWE-754
Priority MEDIUM 40
A flaw was found in Netty RtspDecoder.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00865 · Published 2026-09-18 · Partial fix · 4.1.138.Final-redhat-00001, 26.4.17-2 +4 CWE-1035
Priority MEDIUM 40
The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the z…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00603 · Published 2026-09-16 · Partial fix CWE-862
Priority MEDIUM 40
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0063 · Published 2026-08-13 · Partial fix · 4.1.136.Final, 4.2.16.Final CWE-772
Priority LOW 37
A flaw was found in Netty's HTTP/2 stack.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.0108 · Published 2026-09-18 · Partial fix · 26.4.17-2, 26.4-29 +3 CWE-1035
Priority LOW 37
A flaw was found in Netty's HTTP/1.1 decoder.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.0108 · Published 2026-09-18 · Partial fix · 26.4.17-2, 26.4-29 +3 CWE-444
Priority LOW 37
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00429 · Published 2026-07-14 · Partial fix · 12.0.36, 12.1.10 CWE-200
Priority LOW 36
A flaw was found in Netty.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00578 · Published 2026-09-18 · Partial fix · 26.4.17-2, 26.4-29 +3 CWE-1035
Priority LOW 36
A flaw was found in WildFly Elytron.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01035 · Published 2026-08-20 · Partial fix · 2.8.4.Final-redhat-00002, 26.4.17-2 +4 CWE-173
Priority LOW 35
c3p0 is a JDBC Connection pooling library.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0048 · Published 2026-06-30 · Partial fix · 0.14.0 CWE-502
Priority LOW 35
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization.
CVSS 4.0HIGH 8.2· Local · Low privileges · No interaction · EPSS 0.00145 · Published 2026-08-11 · Partial fix · 5.9.2 CWE-532
Priority LOW 32
A flaw was found in Netty's `netty-codec-http` component.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.0167 · Published 2026-09-18 · Partial fix · 26.4.17-2, 26.4-29 +3 CWE-444
Priority LOW 31
A flaw was found in Netty's HTTP/2 HpackEncoder.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00481 · Published 2026-09-18 · Partial fix · 26.4.17-2, 26.4-29 +3 CWE-1035
Priority LOW 30
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response mes…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00464 · Published 2026-07-31 · Partial fix · 5.6.3 CWE-772
Priority LOW 26
Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a dangerous antipattern that general-purpose instrumentation should never perform.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00301 · Published 2026-08-21 · Partial fix CWE-74
THREATIST.IORead the docs