Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.
Product
Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.
Vulnerabilities 23
-
High 8.2
Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prio…
-
High 7.5
Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connectio…
-
High 7.5
Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, lead…
-
High 7.5
Io.netty/netty-codec-stomp: netty: bytebuf leak in stompsubframedecoder when a frame body is never terminated
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) …
-
High 7.5
Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-co…
-
High 7.5
Io.netty/netty-codec-stomp: netty: stomp codec content-length long-to-int truncation causes infinite decode loop dos
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a De…
-
High 7.5
Io.netty/netty-codec-smtp: netty: unbounded multi-line response accumulation in smtpresponsedecoder leads to memory-exhaustion dos
A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vul…
-
High 7.5
Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS)…
-
High 7.5
Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP re…
-
High 7.5
Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by su…
-
High 7.5
Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT request…
-
High 7.5
Io.netty/netty-codec-redis: netty: redisarrayaggregator nested resp headers multiply patched preallocation limits
A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of h…
-
High 7.5
Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allow…
-
High 7.5
Io.netty/netty-codec-smtp: netty netty-codec-smtp — smtp command-name field is not crlf-validated (incomplete fix of cve-2025-59419)
A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/L…
-
Medium 6.5
Io.netty/netty-codec-memcache: netty: memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling
A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mi…
-
Medium 6.5
Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, po…
-
Medium 6.5
Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HT…
-
Medium 6.5
Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer c…
-
Medium 6.5
Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTT…
-
Medium 6.5
Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP…
-
Medium 5.9
Io.netty/netty-handler-ssl-ocsp: netty: ocsp validation silently skipped when a response omits the optional nextupdate field
A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) response that omits the optional `nextUpdate` field. This omission causes the OCSP valid…
-
Medium 5.9
Io.netty/netty-handler-ssl-ocsp: netty: missing extended key usage (eku) check in ocsp client allows certificate revocation bypass
A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certi…
-
Medium 5.3
Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CP…
Revision history
-
#11
Neue Updates von Red Hat aufgenommen
-
#10
Neue Updates von Red Hat aufgenommen
-
#9
Neue Updates von Red Hat aufgenommen
-
#8
Neue Updates von IBM aufgenommen
-
#7
Neue Updates von IBM aufgenommen
-
#6
Neue Updates von IBM aufgenommen
-
#5
Neue Updates von openSUSE aufgenommen
-
#4
Neue Updates von SUSE aufgenommen
-
#3
Neue Updates von Red Hat aufgenommen
-
#2
Neue Updates von Red Hat aufgenommen
-
#1
Initiale Fassung
References
-
Red Hat Bugtracker 2536887 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536887
-
GitHub Security Advisory GHSA-mrqx-2r72-2c2x vom 2026-09-20
https://github.com/advisories/GHSA-mrqx-2r72-2c2x
-
Red Hat Bugtracker 2536891 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536891
-
GitHub Security Advisory GHSA-c593-fgx2-8jj6 vom 2026-09-20
https://github.com/advisories/GHSA-c593-fgx2-8jj6
-
Red Hat Bugtracker 2536895 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536895
-
GitHub Security Advisory GHSA-9rhx-p462-pg2j vom 2026-09-20
https://github.com/advisories/GHSA-9rhx-p462-pg2j
-
GitHub Security Advisory GHSA-xvr4-c5q3-q5wm vom 2026-09-20
https://github.com/advisories/GHSA-xvr4-c5q3-q5wm
-
GitHub Security Advisory GHSA-wfpc-rccm-rq4m vom 2026-09-20
https://github.com/advisories/GHSA-wfpc-rccm-rq4m
-
Red Hat Bugtracker 2536932 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536932
-
GitHub Security Advisory GHSA-258J-9683-M467 vom 2026-09-20
https://github.com/advisories/GHSA-258J-9683-M467
-
Red Hat Bugtracker 2536949 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536949
-
GitHub Security Advisory GHSA-7p33-hhxj-4qcr vom 2026-09-20
https://github.com/advisories/GHSA-7p33-hhxj-4qcr
-
Red Hat Bugtracker 2536951 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536951
-
GitHub Security Advisory GHSA-MV3R-X43M-8MR7 vom 2026-09-20
https://github.com/advisories/GHSA-MV3R-X43M-8MR7
-
Red Hat Bugtracker 2536953 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536953
-
GitHub Security Advisory GHSA-74QM-9QC5-FF4G vom 2026-09-20
https://github.com/advisories/GHSA-74QM-9QC5-FF4G
-
Red Hat Bugtracker 2536952 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536952
-
GitHub Security Advisory GHSA-6F4P-H3XM-C8RC vom 2026-09-20
https://github.com/advisories/GHSA-6F4P-H3XM-C8RC
-
Red Hat Bugtracker 2536954 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536954
-
GitHub Security Advisory GHSA-9mrj-55p4-qwf4 vom 2026-09-20
https://github.com/advisories/GHSA-9mrj-55p4-qwf4
-
Red Hat Bugtracker 2536955 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536955
-
Red Hat Bugtracker 2536961 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536961
-
GitHub Security Advisory GHSA-ffvg-hfwh-x2pp vom 2026-09-20
https://github.com/advisories/GHSA-ffvg-hfwh-x2pp
-
Red Hat Bugtracker 2536962 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536962
-
GitHub Security Advisory GHSA-jmx3-m859-mrgc vom 2026-09-20
https://github.com/advisories/GHSA-jmx3-m859-mrgc
-
Red Hat Bugtracker 2536964 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536964
-
Red Hat Bugtracker 2536966 vom 2026-09-20
https://bugzilla.redhat.com/show_bug.cgi?id=2536966
-
GitHub Security Advisory GHSA-c9wq-39xx-437p vom 2026-09-20
https://github.com/advisories/GHSA-c9wq-39xx-437p
-
GitHub Security Advisory GHSA-fcr3-v77c-x7hx vom 2026-09-20
https://github.com/advisories/GHSA-fcr3-v77c-x7hx
-
GitHub Security Advisory GHSA-4wrp-2fvc-9x8r vom 2026-09-20
https://github.com/advisories/GHSA-4wrp-2fvc-9x8r
-
GitHub Security Advisory GHSA-6w3j-2wqp-7r38 vom 2026-09-20
https://github.com/advisories/GHSA-6w3j-2wqp-7r38
-
Red Hat Security Advisory RHSA-2026:69440 vom 2026-09-21
https://access.redhat.com/errata/RHSA-2026:69440
-
Red Hat Security Advisory RHSA-2026:69470 vom 2026-09-21
https://access.redhat.com/errata/RHSA-2026:69470
-
Red Hat Security Advisory RHSA-2026:70257 vom 2026-09-22
https://access.redhat.com/errata/RHSA-2026:70257
-
SUSE Security Update SUSE-SU-2026:4391-1 vom 2026-09-29
https://lists.suse.com/pipermail/sle-security-updates/2026-September/029455.html
-
openSUSE Security Update OPENSUSE-SU-2026:11882-1 vom 2026-09-30
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GHLPH6OXFMQ7R346ZKQZMBEXEHX7YG6T/
-
IBM Security Bulletin 7291775 vom 2026-10-09
https://www.ibm.com/support/pages/node/7291775
-
IBM Security Bulletin 7291851 vom 2026-10-09
https://www.ibm.com/support/pages/node/7291851
-
IBM Security Bulletin 7292443 vom 2026-10-14
https://www.ibm.com/support/pages/node/7292443
-
IBM Security Bulletin 7292642 vom 2026-10-15
https://www.ibm.com/support/pages/node/7292642
-
Red Hat Security Advisory RHSA-2026:83612 vom 2026-10-15
https://access.redhat.com/errata/RHSA-2026:83612
-
IBM Security Bulletin 7292669 vom 2026-10-15
https://www.ibm.com/support/pages/node/7292669
-
Red Hat Security Advisory RHSA-2026:95221 vom 2026-11-04
https://access.redhat.com/errata/RHSA-2026:95221
-
Red Hat Security Advisory RHSA-2026:95887 vom 2026-11-06
https://access.redhat.com/errata/RHSA-2026:95887