These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-29T19:16:48.740Z and has not been modified since then. The NVD entry is currently Analyzed. The vulnerability in Netty allows an attacker to force a WebSocket upgrade via the lax V07 handshaker, enabling HTTP request smuggling and protocol-confusion attacks. This issue was fixed in Netty versions 4. [truncated]
Netty is an asynchronous, event-driven network application framework. A vulnerability in Netty's STOMP encoder (StompSubframeEncoder) allows an attacker to inject additional STOMP headers by not escaping or validating header values in CONNECT and CONNECTED frames. This issue affects Netty versions prior to 4.1.136.Final and 4.2.16.Final, with a CVSS score of 6.5 and MEDIUM severity. The vulnerability can [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-29T18:16:56.467Z and has not been modified since then. This CVE-2026-59901 vulnerability affects Netty, an asynchronous, event-driven network application framework. The vulnerability class is a denial-of-service (DoS) attack through a malformed bzip2 stream that permanently captures the event-loop t [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-29T18:16:56.320Z and has not been modified since then. Netty's HTTP/2-to-HTTP/1.x translation layer fails to deduplicate or validate 'Host' headers when an HTTP/2 client supplies both the ':authority' pseudo-header and a literal 'host' header in a single HEADERS frame. The translator maps ':authorit [truncated]
The CVE-2026-56822 vulnerability affects Netty, an asynchronous, event-driven network application framework. This vulnerability allows sensitive application data to be leaked to a revoked server before the channel is closed by the OCSP check. Users of Netty versions prior to 4.1.136.Final and 4.2.16.Final are affected. The vulnerability is caused by the OcspServerCertificateValidator forwarding the SslHan [truncated]
Netty, an asynchronous event-driven network application framework, has a vulnerability in its OcspServerCertificateValidator. This validator flags out-of-date OCSP responses but does not stop processing them, potentially allowing an on-path attacker to bypass certificate revocation via replay of an expired GOOD response. The affected versions are prior to 4.1.136.Final and 4.2.16.Final. Teams using these [truncated]
CVE-2026-59921 is a vulnerability in Netty's HttpPostRequestEncoder, allowing for arbitrary MIME header injection due to unsanitized CRLF characters in user-supplied filenames and field names. This issue is fixed in Netty versions 4.1.136.Final and 4.2.16.Final. Affected users should verify their Netty versions and apply updates if necessary. The CVE record was published on 2026-07-28T23:17:09.923Z and ha [truncated]
CVE-2026-56820 is a high-severity vulnerability in Netty, a network application framework, that allows for replay attacks due to improper OCSP response validation. The issue affects Netty versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final. The vulnerability is caused by the `OcspClient` not validating that the `CertificateID` in an OCSP response matches the requested `CertificateID`, whi [truncated]
CVE-2026-56819 is a high-severity vulnerability affecting Netty, a network application framework used for developing protocol servers and clients. The issue, rated with a CVSS score of 7.5, allows a remote unauthenticated peer to cause memory exhaustion by leaking one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. This [truncated]
CVE-2026-56817 is a high-severity vulnerability in Netty, a network application framework. The issue allows for conditional XML external entity risk due to DTD and entity handling being active in certain configurations. This vulnerability affects Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. It was fixed in versions 4.1.136.Final and 4.2.16.Final.
CVE-2026-56816 is a high-severity denial of service vulnerability in Netty's Http3FrameCodec. The issue arises from the codec's ability to buffer incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits. This allows an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths, potentially causing memory exhaustion. The vulne [truncated]
CVE-2026-56746 is a security control bypass vulnerability in Netty, a network application framework. The issue affects versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. The vulnerability occurs in the CorsHandler's origin evaluation process, allowing an attacker to bypass security controls by sending a request with an Origin: null header. This bypasses the short-circuit mech [truncated]
CVE-2026-56745 is a high-severity vulnerability affecting Netty, a network application framework used for developing protocol servers and clients. The vulnerability exists in versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final. The issue arises in the `SpdyHttpDecoder` handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` [truncated]
CVE-2026-55851 is a denial-of-service vulnerability in Netty's HAProxyMessageDecoder. The issue arises from improper protocol version detection, leading to an unbounded cumulation buffer that can exhaust direct memory. This vulnerability affects Netty versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135. The issue is fixed in versions 4.1.136.Final [truncated]
CVE-2026-55833 is a high-severity vulnerability in Netty, a network application framework. The issue affects versions prior to 4.1.136.Final and 4.2.16.Final. Netty's SPDY header decoding process continues to inflate zlib-compressed header blocks even after the raw header parser has exceeded the `maxHeaderSize` limit and marked the frame as truncated in `SpdyFrameCodec`. This allows a remote peer to send [truncated]
Netty is vulnerable to a denial-of-service (DoS) attack due to improper handling of SPDY SETTINGS frames. A remote attacker can send a specially crafted SETTINGS frame to cause excessive heap growth and ordered-map insertion work, leading to a potential DoS. This issue affects Netty versions prior to 4.1.136.Final and 4.2.16.Final, and users should be aware of this vulnerability and take steps to mitigate it.
CVE-2026-44891 is a denial of service vulnerability in Netty's StompSubframeDecoder. The issue is fixed in Netty versions 4.1.136.Final and 4.2.16.Final. This vulnerability allows an attacker to send a large number of short headers that accumulate in memory, causing an OutOfMemoryError and denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. Users of affected versions sho [truncated]
CVE-2026-50560 is a vulnerability in Netty, a network application framework. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. The vulnerability is caused by the `SETTINGS_MAX_HEADER_LIST_SIZE` setting in the http2 specification. When a client sends this setting to Netty, it can cause Netty to behave in a way that is [truncated]
CVE-2026-50020 is a vulnerability in Netty's HttpObjectDecoder. Prior to versions 4.1.135.Final and 4.2.15.Final, the decoder skips certain bytes, including non-CRLF control characters, which can lead to request-boundary confusion in pipelined or multiplexed transports. This vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity.
A vulnerability was discovered in Netty, a network application framework, affecting the RedisArrayAggregator component. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator pre-allocates an ArrayList with an initial capacity equal to the RESP array element count declared in an array header. This count is taken from the wire before the corresponding child messages exist, allowing a sm [truncated]
CVE-2026-50010 is a HIGH severity vulnerability in Netty, a network application framework. The issue arises from how Netty handles trust managers. Specifically, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper. This wrapper extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authTyp [truncated]
CVE-2026-50009 is a vulnerability in Netty, a network application framework. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. This allows an on-path attacker to derive the reset token for the server's current source connection ID from bytes that appear as the connection ID i [truncated]
CVE-2026-48748 is a high-severity vulnerability in the Netty HTTP/3 codec that allows for memory exhaustion via the creation of an infinite number of blocked streams, potentially leading to an Out-of-Memory (OOM) error. This issue was patched in Netty version 4.2.15.Final.
A memory leak vulnerability exists in Netty's HAProxy PROXY protocol v2 codec. This issue can occur when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs at depth two or greater. The leak happens on the successful parse path, with no exception thrown, and the message fires downstream. However, the underlying cumulation buffer remains permanently pinned. This issue affects [truncated]
CVE-2026-48043 is a vulnerability in the Netty network application framework, specifically in the netty-codec-http2 component. The `DelegatingDecompressorFrameListener` class is susceptible to a resource leak due to improper handling of decompressed chunks. This could lead to an Out-of-Memory Error (OOME) and potentially take down the entire JVM. The vulnerability has a CVSS score of 5.3 and is classified [truncated]
A high-severity vulnerability was discovered in Netty, a network application framework. The RedisArrayAggregator handler is susceptible to a denial-of-service attack due to a memory leak. When a Redis pipeline connection closes before a RESP array aggregate completes, the handler retains child messages in its state without releasing them, leading to a permanent leak of pooled direct-memory buffers. This i [truncated]
CVE-2026-47691 is a HIGH severity vulnerability in Netty, a network application framework, that allows for DNS Cache Poisoning due to insufficient validation of NS records in the `DnsResolveContext`. This vulnerability affects Netty versions prior to 4.1.135.Final and 4.2.15.Final. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability to poison the cache for p [truncated]
CVE-2026-47244 is a vulnerability in Netty's HTTP/2 server implementation. Prior to versions 4.1.135.Final and 4.2.15.Final, the server could allocate excessive stream objects, potentially leading to resource exhaustion and amplification attacks. The issue arises from the DefaultHttp2Connection.DefaultEndpoint initializing maxActiveStreams/maxStreams to Integer.MAX_VALUE and Http2Settings not inserting SE [truncated]
CVE-2026-46340 is a HIGH severity vulnerability in Netty, a network application framework. The vulnerability affects netty-transport-sctp and can cause a Denial of Service (DoS) attack. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, an attacker can grow the accumulator structure indefinitely from tiny 1-byte DATA chunks by never setting the `complete` flag. This can lead to a [truncated]
CVE-2026-45674 is a HIGH severity vulnerability in Netty's DnsResolveContext. The vulnerability fails to validate the origin (bailiwick) of CNAME records in DNS responses, potentially allowing for DNS response spoofing. This issue was patched in Netty versions 4.1.135.Final and 4.2.15.Final.
CVE-2026-45673 is a DNS Cache Poisoning vulnerability in Netty, a network application framework. The vulnerability has a CVSS score of 6.8 and was published on 2026-06-12T15:16:27.417Z. The vulnerability exists in Netty's DNS resolver, which uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS [truncated]
CVE-2026-45536 is a MEDIUM severity vulnerability in Netty, a network application framework. The vulnerability occurs in the netty_unix_socket_recvFd function, where a peer-sent SCM_RIGHTS cmsg carrying two ints can cause a file descriptor leak. This happens when the application opts into DomainSocketReadMode.FILE_DESCRIPTORS (non-default) via Epoll/KQueue DomainSocketChannel. The issue is patched in vers [truncated]
CVE-2026-45416 is a vulnerability in the Netty network application framework. The SslClientHelloHandler.decode() method reads the 24-bit TLS handshake length and allocates a buffer of that size. However, the guard against large handshake lengths is disabled when using certain constructors, such as SniHandler(Mapping), SniHandler(AsyncMapping), and AbstractSniHandler(). This allows for a large allocation o [truncated]
CVE-2026-44894 is a vulnerability in Netty's NoQuicTokenHandler. Prior to version 4.2.15.Final, it incorrectly validates tokens, allowing an attacker to bypass the 3× anti-amplification send limit. This could lead to a high-impact attack, with a CVSS score of 7.5.
CVE-2026-44893 is a HIGH severity vulnerability in Netty's netty-codec-haproxy component. When decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() is susceptible to IndexOutOfBoundsException if the attacker sets the TLV length below 5. This occurs because `header.retainedSlice(header.readerIndex(), length)` is called before reading the 1-byte client field and 4-byte verify field. The exception propa [truncated]
CVE-2026-44892 is a HIGH severity vulnerability in the Netty network application framework. The `Http3ConnectionHandler` in the Netty HTTP/3 codec has a default configuration that lacks an enforced maximum header size limit. When a peer does not specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This allows a malicious client or server to send an enormous n [truncated]
CVE-2026-44890 is a high-severity vulnerability in Netty, a network application framework. The vulnerability allows an attacker to cause a Denial of Service (DoS) by sending crafted Redis payloads across multiple connections without `r n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. The vulnerability affects netty-codec-re [truncated]
CVE-2026-44250 is a high-severity vulnerability in Netty's netty-codec-redis component. An attacker can cause a Denial of Service (DoS) by sending a crafted Redis payload with deeply nested arrays, leading to memory exhaustion and an OutOfMemoryError. This vulnerability has a CVSS score of 7.5 and is considered HIGH severity. The issue was patched in versions 4.1.135.Final and 4.2.15.Final of Netty.
CVE-2026-44249 is a high-severity vulnerability in Netty's netty-handler component. An attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. The issue was patched in versions 4.1.135.Final and 4.2.15.Final.
CVE-2026-48480 is a MEDIUM severity vulnerability in the Netty Incubator Codec OHTTP, a Java language binary HTTP parser. Prior to version 0.0.22.Final, the codec-ohttp implementation of draft-ietf-ohai-chunked-ohttp does not verify that a cryptographically-signed final chunk was received before the outer HTTP body terminates. This allows an on-path adversary (the OHTTP relay itself, or any MITM on the re [truncated]
CVE-2026-48040 is a vulnerability in the Netty incubator codec.bhttp, a Java language binary HTTP parser. The library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for cryptographic operations, versions prior to 0.0.22.Final provide a fallback path for direct ByteBufs that do not expose their memory address through `hasMemoryAddress()` [truncated]
The Netty-Incubator-Codec-Ohttp, a Java language binary HTTP parser, has a vulnerability in its HKDF (Keyed-Hash Message Authentication Code) key material generation. Prior to version 0.0.21.Final, the HKDF_expand function returns a non-NULL value on failure, which is a byte array filled with zeros. This makes it impossible to distinguish between a successful and failed operation. The output of this funct [truncated]
CVE-2026-44248 is a medium-severity uncontrolled resource consumption vulnerability in Netty's MQTT 5 decoder. The flaw exists because the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method executes before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check, allowing decodeProperties [truncated]
Netty's HttpContentDecompressor and DelegatingDecompressorFrameListener fail to enforce the maxAllocation decompression limit for Brotli (br), zstd, and snappy encodings, allowing attackers to bypass memory protections by using alternative Content-Encoding headers. This enables unbounded memory allocation leading to out-of-memory denial of service. The vulnerability affects Netty versions prior to 4.1.133 [truncated]
Netty versions prior to 4.1.133.Final and 4.2.13.Final contain an HTTP request smuggling vulnerability stemming from incorrect parsing of malformed Transfer-Encoding headers. The flaw allows attackers to manipulate how front-end and back-end servers interpret HTTP request boundaries, potentially enabling unauthorized access to internal systems, cache poisoning, or credential hijacking. The vulnerability c [truncated]
CVE-2026-42584 is a Netty HTTP client desynchronization issue affecting versions before 4.1.133.Final and 4.2.13.Final. In the vulnerable flow, HttpClientCodec can pair inbound responses to outbound requests incorrectly when pipelined requests include a GET followed by a HEAD and the server sends a 103 interim response, then a 200 for the GET body, then a 200 for the HEAD. The mismatch can cause the HEAD [truncated]
Netty's Lz4FrameDecoder contains an uncontrolled resource consumption vulnerability (CWE-400/CWE-770) that allows remote attackers to trigger excessive memory allocation. The decoder allocates a ByteBuf sized to the attacker-supplied decompressedLength (up to 32 MB per block) before any LZ4 decompression occurs. A malicious peer can force this allocation with only 21-22 bytes of network traffic, making th [truncated]
Netty's HttpObjectDecoder contains an HTTP request smuggling vulnerability affecting HTTP/1.0 requests. When both Transfer-Encoding: chunked and Content-Length headers are present, the decoder strips the conflicting Content-Length header for HTTP/1.1 but fails to apply the same protection for HTTP/1.0. This causes Netty to decode the body as chunked while preserving Content-Length in the forwarded HttpMes [truncated]
Netty's HTTP chunk size parser contains an integer overflow vulnerability that enables HTTP request smuggling attacks. The flaw occurs when parsing chunked transfer-encoding sizes, where a malformed chunk size value silently overflows the signed 32-bit integer type, causing Netty to misinterpret chunk boundaries. This can desynchronize the HTTP request/response stream between Netty-based servers and downs [truncated]
Netty's DNS codec fails to enforce RFC 1035 domain name constraints during encoding and decoding operations, creating a bidirectional attack surface. Malicious DNS responses can exploit the decoder, while attacker-influenced hostnames can exploit the encoder. The vulnerability affects Netty versions prior to 4.1.133.Final and 4.2.13.Final. This is a HIGH severity issue (CVSS 7.5) with network attack vecto [truncated]