Skip to content
OpenAdvisories
High WID-SEC-2026-2356 17 CVEs

Netty: Mehrere Schwachstellen

Published Jul 14, 2026 · Updated Oct 25, 2026 · Revision 19 · de-DE

Vendor: IBM Vendor: Red Hat Vendor: SUSE Product: App Connect Enterprise Product: Db2 Product: Enterprise Linux Product: License Metric Tool Product: Linux Product: SPSS Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsprüfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen.

Product

Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.

Vulnerabilities 17

  • High 8.7
    CVE-2026-55851

    Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy`…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-56745

    Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteB…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-59901

    Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stre…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.3
    CVE-2026-56817

    Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder`…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-44891

    Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

    Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame,…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-55831

    Netty SPDY SETTINGS frame count materializes unbounded settings map

    Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-55833

    Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

    Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeader…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-56816

    Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

    Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFra…

    netty netty netty netty Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-56819 Public exploit

    Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame i…

    netty netty druid trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2026-56820

    Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requeste…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2026-56821

    Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still…

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • High 7.4
    CVE-2026-56822

    Netty: TOCTOU in OcspServerCertificateValidator

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows …

    netty netty thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  • Medium 6.9
    CVE-2026-59899

    Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.9
    CVE-2026-59900

    Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2026-59920

    Netty: STOMP CONNECT Frame Header Injection

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in  CONNECT  and  CONNECTED  frames, so raw new…

    netty netty netty netty Debian Ubuntu Wolfi Maven
  • Medium 6.3
    CVE-2026-59898

    Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection:…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.7
    CVE-2026-59921

    Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Cont…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Revision history

  1. #19

    Neue Updates von IBM aufgenommen

  2. #18

    Neue Updates von IBM aufgenommen

  3. #17

    Neue Updates von Red Hat aufgenommen

  4. #16

    Neue Updates von Red Hat aufgenommen

  5. #15

    Neue Updates von Red Hat aufgenommen

  6. #14

    Neue Updates von Red Hat aufgenommen

  7. #13

    Neue Updates von Red Hat und IBM aufgenommen

  8. #12

    Neue Updates von Red Hat aufgenommen

  9. #11

    Neue Updates von IBM aufgenommen

  10. #10

    Neue Updates von Red Hat aufgenommen

  11. #9

    Neue Updates von Red Hat aufgenommen

  12. #8

    Neue Updates von IBM aufgenommen

  13. #7

    Neue Updates von SUSE aufgenommen

  14. #6

    Neue Updates von Red Hat und European Union Vulnerability Database aufgenommen

  15. #5

    Referenz(en) aufgenommen: EUVD-2026-50091, EUVD-2026-50090, EUVD-2026-50089

  16. #4

    Referenz(en) aufgenommen: EUVD-2026-46452, EUVD-2026-46438, EUVD-2026-47564, EUVD-2026-47579, EUVD-2026-47582, EUVD-2026-47581

  17. #3

    Referenz(en) aufgenommen: EUVD-2026-46133, EUVD-2026-46132

  18. #2

    Referenz(en) aufgenommen: EUVD-2026-45316

  19. #1

    Initiale Fassung

References