Skip to content
OpenAdvisories
High WID-SEC-2026-1814 21 CVEs

Netty: Mehrere Schwachstellen

Published Jun 7, 2026 · Updated Nov 11, 2026 · Revision 29 · de

Vendor: IBM Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: App Connect Enterprise Product: Cognos Analytics Product: Concert Product: Db2 Product: Enterprise Linux Product: License Metric Tool Product: Linux Product: Linux Product: Operational Decision Manager Product: Planning Analytics Product: SPSS Product: Sterling Connect:Direct Product: Storage Scale

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.

Vulnerabilities 21

  • High 8.7
    CVE-2026-45674 Public exploit

    Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-47691

    Netty has Insufficient Bailiwick Validation for NS Records

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An atta…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-48006

    Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-48059

    Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a synt…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-44249

    Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

    Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.c…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-44250

    Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This force…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-44890

    Netty has Unbounded Direct Memory Consumption in its RedisDecoder

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-44892

    Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size

    Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a pe…

    netty netty trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-44893

    Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-44894

    Netty's Default QUIC token handler accepts any client-supplied token

    Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Re…

    netty netty trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-45416

    Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the firs…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-46340

    Netty: SCTP reassembly nests buffers without bound

    Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpoole…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-48748

    Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

    Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number …

    netty netty netty netty Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-50010

    Netty's wrapping plain trust manager silently disables hostname verification

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.9
    CVE-2026-50560

    Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.8
    CVE-2026-45673

    Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source por…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-47244

    Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-48043

    netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a p…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-50020

    Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `t…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 4.8
    CVE-2026-50009

    Netty QUIC stateless reset token material exposed through header-visible connection IDs

    Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token…

    netty netty netty netty Debian Ubuntu Wolfi Maven
  • Medium 4.0
    CVE-2026-45536

    Netty: Unix-socket fd receive leaks descriptors when peer sends two at once

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Li…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Revision history

  1. #29

    Neue Updates von IBM aufgenommen

  2. #28

    Neue Updates von IBM aufgenommen

  3. #27

    Neue Updates von IBM aufgenommen

  4. #26

    Neue Updates von IBM aufgenommen

  5. #25

    Neue Updates von IBM aufgenommen

  6. #24

    Neue Updates von Red Hat aufgenommen

  7. #23

    Neue Updates von IBM aufgenommen

  8. #22

    Neue Updates von Red Hat und IBM aufgenommen

  9. #21

    Neue Updates von Ubuntu aufgenommen

  10. #20

    Neue Updates von Red Hat aufgenommen

  11. #19

    Neue Updates von Red Hat aufgenommen

  12. #18

    Neue Updates von Red Hat aufgenommen

  13. #17

    Neue Updates von IBM aufgenommen

  14. #16

    Neue Updates von Red Hat aufgenommen

  15. #15

    Neue Updates von Red Hat aufgenommen

  16. #14

    Neue Updates von Red Hat aufgenommen

  17. #13

    Neue Updates von IBM aufgenommen

  18. #12

    Neue Updates von Red Hat aufgenommen

  19. #11

    Neue Updates von Red Hat und IBM aufgenommen

  20. #10

    Neue Updates von Red Hat aufgenommen

  21. #9

    Neue Updates von Red Hat aufgenommen

  22. #8

    Neue Updates von IBM aufgenommen

  23. #7

    Neue Updates von Red Hat aufgenommen

  24. #6

    Neue Updates von Red Hat aufgenommen

  25. #5

    Referenz(en) aufgenommen: CVE-2026-50009

References