Skip to content
OpenAdvisories

Package · Wolfi

selenium-server

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.8
    CVE-2026-45673

    Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source por…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2026-42585

    Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Fi…

    netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2026-42580

    Netty: HTTP Request Smuggling due to incorrect chunk size parsing

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

    netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  • Medium 5.8
    CVE-2026-42581

    Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-41417

    Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

    Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, b…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.9
    CVE-2025-58057

    Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below,…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven