Search
Search Results (11 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93579 | 2 Io.netty, Redhat | 23 Netty-codec-http2, Amq Broker, Apicurio Registry and 20 more | 2026-11-06 | 6.5 Medium |
| A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses. | ||||
| CVE-2026-93492 | 2 Io.netty, Redhat | 24 Netty-codec-http2, Amq Broker, Amq Broker 7 and 21 more | 2026-11-06 | 5.3 Medium |
| A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS). | ||||
| CVE-2026-93574 | 2 Io.netty, Redhat | 22 Netty-codec-http, Amq Broker, Amq Clients and 19 more | 2026-11-06 | 6.5 Medium |
| A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments. | ||||
| CVE-2026-93573 | 2 Io.netty, Redhat | 22 Netty-codec-http, Amq Broker, Amq Clients and 19 more | 2026-11-06 | 6.5 Medium |
| A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context. | ||||
| CVE-2026-93562 | 2 Io.netty, Redhat | 22 Netty-codec-http, Amq Broker, Amq Clients and 19 more | 2026-11-06 | 6.5 Medium |
| A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources. | ||||
| CVE-2026-93569 | 2 Io.netty, Redhat | 23 Netty-codec-http, Amq Broker, Apache Camel Quarkus and 20 more | 2026-11-06 | 8.2 High |
| A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests. | ||||
| CVE-2026-93568 | 2 Io.netty, Redhat | 24 Netty-codec-http, Amq Broker, Apache Camel Quarkus and 21 more | 2026-11-06 | 7.5 High |
| A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss. | ||||
| CVE-2026-93567 | 2 Io.netty, Redhat | 24 Netty-codec-http2, Amq Broker, Apache Camel Quarkus and 21 more | 2026-11-06 | 7.5 High |
| A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss. | ||||
| CVE-2026-93558 | 2 Io.netty, Redhat | 24 Netty-codec-http, Amq Broker, Amq Broker 7 and 21 more | 2026-11-06 | 7.5 High |
| A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server. | ||||
| CVE-2026-93491 | 2 Io.netty, Redhat | 23 Netty-codec-http, Amq Broker, Amq Broker 7 and 20 more | 2026-11-06 | 7.5 High |
| A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion. | ||||
| CVE-2026-93488 | 2 Io.netty, Redhat | 23 Netty-codec-http, Amq Broker, Amq Clients and 20 more | 2026-11-06 | 7.5 High |
| A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service. | ||||
Page 1 of 1.