Skip to content
OpenAdvisories
High WID-SEC-2026-3291 12 CVEs

Netty: Mehrere Schwachstellen

Published Sep 9, 2026 · Updated Nov 8, 2026 · Revision 9 · de

Vendor: IBM Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: openSUSE Product: Operational Decision Manager Product: SPSS

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Denial-of-Service-Zustände zu verursachen, Sicherheitsmaßnahmen zu umgehen, Request- oder Response-Smuggling durchzuführen sowie Daten offenzulegen oder zu manipulieren.

Product

Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.

Vulnerabilities 12

  • High 8.7
    CVE-2026-100656 Rejected

    This CVE ID has been rejected as a duplicate.

    netty Debian
  • High 8.7
    CVE-2026-100657 Rejected

    This CVE ID has been rejected as a duplicate.

    netty Debian
  • High 7.5
    CVE-2026-100660

    Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

    Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK d…

    netty netty netty Ubuntu
  • High 7.5
    CVE-2026-100661

    Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

    Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation byte…

    netty netty netty Ubuntu
  • High 7.5
    CVE-2026-100662

    Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

    Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidir…

    netty netty netty Ubuntu
  • High 7.5
    CVE-2026-100663

    Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

    Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form targ…

    netty netty netty Ubuntu
  • High 7.5
    CVE-2026-100664

    Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

    Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUti…

    netty netty netty Ubuntu
  • High 7.5
    CVE-2026-100665

    Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

    Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust m…

    netty netty netty Ubuntu
  • Medium 6.9
    CVE-2026-100655 Rejected

    This CVE ID has been rejected as a duplicate.

    netty Debian
  • Medium 6.9
    CVE-2026-100658 Rejected

    This CVE ID has been rejected as a duplicate.

  • Medium 6.5
    CVE-2026-100659

    Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

    Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote…

    netty netty netty Ubuntu
  • Medium 6.5
    CVE-2026-89044

    Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

    Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Atta…

    netty netty netty netty Debian Ubuntu

Revision history

  1. #9

    Neue Updates von Red Hat aufgenommen

  2. #8

    Neue Updates von IBM aufgenommen

  3. #7

    Neue Updates von Red Hat aufgenommen

  4. #6

    Neue Updates von IBM aufgenommen

  5. #5

    Neue Updates von openSUSE aufgenommen

  6. #4

    Neue Updates von SUSE aufgenommen

  7. #3

    Referenz(en) aufgenommen: CVE-2026-100665, GHSA-4QW4-FMQV-QHV8, CVE-2026-100663, EUVD-2026-87757, CVE-2026-100662, EUVD-2026-87756, CVE-2026-100661, EUVD-2026-87755, CVE-2026-100660, EUVD-2026-87754, CVE-2026-100659, EUVD-2026-87753, CVE-2026-100658, EUVD-2026-87752, CVE-2026-100657, EUVD-2026-87751, CVE-2026-100656, EUVD-2026-87750, CVE-2026-100655, EUVD-2026-87749, EUVD-2026-87759, CVE-2026-100664, EUVD-2026-87758

  8. #2

    Referenz(en) aufgenommen: CVE-2026-89044, EUVD-2026-75633

  9. #1

    Initiale Fassung

References