{"id":"CVE-2026-56818","aliases":["CLSA-2026-1787045999","CLSA-2026-1787049848","CLSA-2026-1787271464","CLSA-2026-1787301097","CLSA-2026-1787306632","CLSA-2026-1787309634","CLSA-2026-1787331164","CLSA-2026-1787333890","CLSA-2026-1787383378","CLSA-2026-1787397404","CLSA-2026-1787671732","CLSA-2026-1789379074","DEBIAN-CVE-2026-56818","EUVD-2026-54558","GHSA-p9jm-q85p-7mcp","GHSA-xpw8-rcwv-8f8p","RHLW-2026-6f1a404174e2316f","ROOT-APP-MAVEN-GHSA-xpw8-rcwv-8f8p","SUSE-SU-2026:3482-1","UBUNTU-CVE-2026-56818","openSUSE-SU-2026:11394-1"],"status":"published","title":"Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00473,"percentile":0.41395,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-401","CWE-703"],"published":"2023-10-10T22:22:54Z","modified":"2026-11-10T19:58:30Z","fixes":[{"ecosystem":"Maven","package":"io.netty:netty-codec-redis","fixed_in":["4.1.136.Final","4.2.16.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.netty:netty-codec-http2","fixed_in":["4.1.100.Final"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.netty:netty-codec-http2","fixed_in":["4.1.97.Final-root.io.1","4.1.97.Final-root.io.2","4.1.97.Final-root.io.3","4.1.97.Final-root.io.4","4.1.97.Final-root.io.5","4.1.97.Final-root.io.6","4.1.97.Final-root.io.7"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.netty:netty-codec-http2","fixed_in":["4.1.97.Final-aikido.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0-Final"},{"fixed":"4.2.16.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.135.Final"},{"fixed":"4.1.135.Final-tuxcare.1"}]}],"versions":["4.1.135.Final"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.130.Final"},{"fixed":"4.1.130.Final-tuxcare.3"}]}],"versions":["4.1.130.Final","4.1.130.Final-tuxcare.1","4.1.130.Final-tuxcare.2"],"bundled":21},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.2"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1"],"bundled":57},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-socks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-stomp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-dev-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-example","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-ssl-ocsp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-microbench","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-classes-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns-native-macos","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-autobahn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-native-image-client-runtime-init","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-osgi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-testsuite-shading","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-blockhound-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-unix-common-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-rxtx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-udt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.1"}]}],"versions":["4.1.119.Final"],"bundled":58},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-buffer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-haproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-memcache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.112.Final"},{"fixed":"4.1.112.Final-tuxcare.6"}]}],"versions":["4.1.112.Final","4.1.112.Final-tuxcare.1","4.1.112.Final-tuxcare.2","4.1.112.Final-tuxcare.3","4.1.112.Final-tuxcare.4","4.1.112.Final-tuxcare.5"],"bundled":39},{"source":"osv","ecosystem":"Debian:12","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16","1:4.1.48-7","1:4.1.48-7+deb12u1","1:4.1.48-7+deb12u2","1:4.1.48-8","1:4.1.48-9"]},{"source":"osv","ecosystem":"Debian:13","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-10+deb13u1","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Debian:14","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136.Final"}]}],"versions":["4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.101.Final","4.1.102.Final","4.1.103.Final","4.1.104.Final","4.1.105.Final","4.1.106.Final","4.1.107.Final","4.1.108.Final","4.1.109.Final","4.1.11.Final","4.1.110.Final","4.1.111.Final","4.1.112.Final","4.1.113.Final","4.1.114.Final","4.1.115.Final","4.1.116.Final","4.1.117.Final","4.1.118.Final","4.1.119.Final","4.1.12.Final","4.1.120.Final","4.1.121.Final","4.1.122.Final","4.1.123.Final","4.1.124.Final","4.1.125.Final","4.1.126.Final","4.1.127.Final","4.1.128.Final","4.1.129.Final","4.1.13.Final","4.1.130.Final","4.1.131.Final","4.1.132.Final","4.1.133.Final","4.1.134.Final","4.1.135.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0-Final"},{"fixed":"4.2.16.Final"}]}],"versions":["4.2.0.Final","4.2.1.Final","4.2.10.Final","4.2.11.Final","4.2.12.Final","4.2.13.Final","4.2.14.Final","4.2.15.Final","4.2.2.Final","4.2.3.Final","4.2.4.Final","4.2.5.Final","4.2.6.Final","4.2.7.Final","4.2.8.Final","4.2.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final"}]}],"versions":["4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final-rhlw-00001"}]}],"versions":["4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"],"bundled":6},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.97.Final-root.io.1"},{"fixed":"4.1.97.Final-root.io.2"},{"fixed":"4.1.97.Final-root.io.3"},{"fixed":"4.1.97.Final-root.io.4"},{"fixed":"4.1.97.Final-root.io.5"},{"fixed":"4.1.97.Final-root.io.6"},{"fixed":"4.1.97.Final-root.io.7"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.97.Final-aikido.7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136-150200.4.53.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.80-150200.3.48.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1","1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:4.0.32-1","1:4.0.33-1","1:4.0.34-1","1:4.0.34-1ubuntu0.1~esm1","1:4.0.34-1ubuntu0.1~esm2","1:4.0.34-1ubuntu0.1~esm3","1:4.0.34-1ubuntu0.1~esm4","1:4.0.34-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1","1:4.1.7-4ubuntu0.1+esm1","1:4.1.7-4ubuntu0.1+esm2","1:4.1.7-4ubuntu0.1+esm3","1:4.1.7-4ubuntu0.1+esm4","1:4.1.7-4ubuntu0.1+esm5","1:4.1.7-4ubuntu0.1+esm6","1:4.1.7-4ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.33-1","1:4.1.33-2","1:4.1.33-3","1:4.1.45-1","1:4.1.45-1ubuntu0.1~esm1","1:4.1.45-1ubuntu0.1~esm2","1:4.1.45-1ubuntu0.1~esm3","1:4.1.45-1ubuntu0.1~esm4","1:4.1.45-1ubuntu0.1~esm6","1:4.1.45-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-4","1:4.1.48-4+deb11u1build0.22.04.1","1:4.1.48-4+deb11u2build0.22.04.1","1:4.1.48-4+deb11u2ubuntu0.1~esm1","1:4.1.48-4+deb11u2ubuntu0.1~esm2","1:4.1.48-4+deb11u2ubuntu0.1","1:4.1.48-4+deb11u2ubuntu0.1+esm1","1:4.1.48-4+deb11u2ubuntu0.1+esm3","1:4.1.48-4+deb11u2ubuntu0.2","1:4.1.48-4+deb11u2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-7","1:4.1.48-8","1:4.1.48-9","1:4.1.48-9ubuntu0.1~esm1","1:4.1.48-9ubuntu0.1~esm2","1:4.1.48-9ubuntu0.1","1:4.1.48-9ubuntu0.1+esm1","1:4.1.48-9ubuntu0.1+esm3","1:4.1.48-9ubuntu0.2","1:4.1.48-9ubuntu0.2+esm1","1:4.1.48-9ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-16","1:4.1.48-16ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-16","1:4.1.48-16ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.136-1.1"}]}],"bundled":19}],"affected_more":363,"products":[{"vendor":"netty","product":"netty"}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-p9jm-q85p-7mcp","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/netty/netty/pull/17065","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/advisories/GHSA-p9jm-q85p-7mcp","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-xpw8-rcwv-8f8p","tags":["web"]},{"url":"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61","tags":["web"]},{"url":"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-44487","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56818.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56818","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-56818","tags":["advisory"]},{"url":"https://github.com/netty/netty","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42586.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-rgrr-p7gp-5xj7","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42586","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rgrr-p7gp-5xj7","tags":["advisory"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","tags":["web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44250.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50085","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53644","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53645","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53646","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44250","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44250.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44250","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3244-j874-rhc2","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44890.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44890","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44890.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44890","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6ghj-frrj-jjj3","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48006.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48006","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48006.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48006","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6jv9-x5w9-2ccm","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50011.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50011","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50011.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50011","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5w86-c3rq-vjj7","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263482-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1271435","tags":["report"]},{"url":"https://bugzilla.suse.com/1271960","tags":["report"]},{"url":"https://bugzilla.suse.com/1271961","tags":["report"]},{"url":"https://bugzilla.suse.com/1272253","tags":["report"]},{"url":"https://bugzilla.suse.com/1272254","tags":["report"]},{"url":"https://bugzilla.suse.com/1272255","tags":["report"]},{"url":"https://bugzilla.suse.com/1272257","tags":["report"]},{"url":"https://bugzilla.suse.com/1272258","tags":["report"]},{"url":"https://bugzilla.suse.com/1272259","tags":["report"]},{"url":"https://bugzilla.suse.com/1272299","tags":["report"]},{"url":"https://bugzilla.suse.com/1272300","tags":["report"]},{"url":"https://bugzilla.suse.com/1272301","tags":["report"]},{"url":"https://bugzilla.suse.com/1272302","tags":["report"]},{"url":"https://bugzilla.suse.com/1272303","tags":["report"]},{"url":"https://bugzilla.suse.com/1272304","tags":["report"]},{"url":"https://bugzilla.suse.com/1272305","tags":["report"]},{"url":"https://bugzilla.suse.com/1272306","tags":["report"]},{"url":"https://bugzilla.suse.com/1272307","tags":["report"]},{"url":"https://bugzilla.suse.com/1272518","tags":["report"]},{"url":"https://bugzilla.suse.com/1272519","tags":["report"]},{"url":"https://bugzilla.suse.com/1272603","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55831","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59921","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-56818","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-56818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2507476","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-56818","title":"Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-08-07T17:14:02.356Z","modified":"2026-08-08T03:01:06.279Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-401","CWE-703"],"updated_at":"2026-11-02T13:36:51.6229Z"}],"euvd":[{"id":"EUVD-2026-54558","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-08-07T17:14:02Z","modified":"2026-08-08T03:01:06Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:02:06.573967Z"}],"ghsa":[{"id":"GHSA-p9jm-q85p-7mcp","title":"Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state","description":"## Summary\n\n`RedisArrayAggregator` clears retained partial aggregate state when the `maxNestedArrayDepth` limit is exceeded, but it does not clear the same state when the sibling `maxElements` limit is exceeded. A peer can start a valid RESP array, send a bulk-string child, then send a nested array header longer than the configured `maxElements`. Netty throws a decoder exception, but the existing partial aggregate remains retained in the handler.\n\nIf the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate. The supplied PoV proves both the retained `ByteBuf` reference and the stale parser state continuation.\n\n## Technical Details\n\n`RedisArrayAggregator.decode(...)` retains non-array messages before adding them to `depths.peek().children`. In `decodeRedisArrayHeader(...)`, the `header.length() \u003e maxElements` branch throws immediately:\n\n```java\nif (header.length() \u003e maxElements) {\n    throw new CodecException(\"this codec doesn't support longer length than \" + maxElements);\n}\n```\n\nThe immediately following nested-depth branch clears retained aggregate state before throwing:\n\n```java\nif (depths.size() \u003e= maxNestedArrayDepth) {\n    releaseAndClearDepths();\n    throw new CodecException(\"max nested array depth exceeded: \" + maxNestedArrayDepth);\n}\n```\n\nThe missing cleanup in the first branch leaves retained children and aggregate state reachable after the exception.\n\n## PoC\n\nPlace the supplied `RedisArrayAggregatorIncompleteCleanupPovTest.java` under:\n\n`codec-redis/src/test/java/io/netty/handler/codec/redis/`\n\nRun:\n\n```fish\n./mvnw -pl codec-redis -am -Dtest=RedisArrayAggregatorIncompleteCleanupPovTest -Dsurefire.failIfNoSpecifiedTests=false -DskipNativeTests -DskipAutobahnTests test\n```\n\nThe test suite includes:\n\n- serialized RESP trigger through `RedisDecoder`, `RedisBulkStringAggregator`, and `RedisArrayAggregator`;\n- direct refcount proof that max-elements overflow does not release the retained child immediately;\n- post-exception continuation proof that the stale aggregate consumes a later message;\n- nested-depth controls that clear the same partial aggregate state.\n\nAll five tests pass on current `4.2`, `4.2.15.Final`, and `4.1.135.Final`.\n\n## Impact\n\nFor Redis codec pipelines that continue after codec exceptions, an unauthenticated peer can keep attacker-controlled aggregate state alive across a security-limit exception. This can pin retained pooled buffers until channel close/removal or until a later message completes the stale aggregate.\n\n`RedisBulkStringAggregator` permits bulk strings up to `RedisConstants.REDIS_MESSAGE_MAX_LENGTH` (`512MB`), so the retained child can be large in deployments that aggregate untrusted Redis streams.\n\nApplications that always close the channel or remove the handler on decoder exceptions will trigger existing cleanup; the issue is the missing immediate cleanup on the max-elements failure path while the handler remains installed.\n\n## Suggested Fix\n\nCall `releaseAndClearDepths()` before throwing from the max-elements branch. Consider applying the same cleanup to all unrecoverable `decodeRedisArrayHeader(...)` error exits that can occur while `depths` is non-empty.\n\n## Affected Package/Versions\n\n`io.netty:netty-codec-redis`\n\nConfirmed on:\n\n- current `4.2` branch head `7bae566a93e69409697fe57fa807910ba5c9720e`\n- `4.2.15.Final` at `a41f7b289ce1`\n- `4.1.135.Final` at `f05f765d8146`\n\n## Advisory History\n\nThis differs from the public Redis codec advisories because it reproduces on their patched tags:\n\n- `GHSA-5w86-c3rq-vjj7`\n- `GHSA-3244-j874-rhc2` / `CVE-2026-44250`\n- `GHSA-6jv9-x5w9-2ccm` / `CVE-2026-48006`\n- `GHSA-6ghj-frrj-jjj3` / `CVE-2026-44890`\n\n## Why This Is Not Intended Behavior\n\nThe public API docs document `RedisArrayAggregator` as aggregating `RedisMessage` parts into `ArrayRedisMessage` and document a `CodecException` when an array header exceeds `maxElements`. They do not document preserving pre-exception partial aggregate state after that limit fires.\n\nThe adjacent nested-depth branch already calls `releaseAndClearDepths()` before throwing. The max-elements branch is the sibling aggregation-limit branch but throws without cleanup. Netty's later Redis lifecycle cleanup patch explicitly added release behavior for nested-array failure and handler removal, leaving the max-elements failure branch as a missed cleanup path.","status":"published","published":"2026-08-07T17:16:13Z","modified":"2026-08-07T17:16:17Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-401","CWE-703"],"updated_at":"2026-11-02T14:40:57.999375Z"},{"id":"GHSA-xpw8-rcwv-8f8p","title":"io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack","description":"A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. \n\n### Impact\nThis is a DDOS attack, any http2 server is affected and so you should update as soon as possible.\n\n### Patches\nThis is patched in version 4.1.100.Final.\n\n### Workarounds\nA user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).\n\n### References\n- https://www.cve.org/CVERecord?id=CVE-2023-44487\n- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/\n- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","status":"published","published":"2023-10-10T22:22:54Z","modified":"2023-11-06T22:08:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:15.055009Z"}],"nvd":[{"id":"CVE-2026-56818","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-08-07T18:17:19.1Z","modified":"2026-09-23T15:56:16.86Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-401","CWE-703"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"CVE-2026-56818","title":"Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-08-07T17:14:02.356Z","modified":"2026-10-28T11:10:04.729940707Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-401","CWE-703"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-56818","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-08-07T18:17:19.1Z","modified":"2026-09-24T08:47:29.76776432Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"GHSA-p9jm-q85p-7mcp","title":"Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state","description":"## Summary\n\n`RedisArrayAggregator` clears retained partial aggregate state when the `maxNestedArrayDepth` limit is exceeded, but it does not clear the same state when the sibling `maxElements` limit is exceeded. A peer can start a valid RESP array, send a bulk-string child, then send a nested array header longer than the configured `maxElements`. Netty throws a decoder exception, but the existing partial aggregate remains retained in the handler.\n\nIf the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate. The supplied PoV proves both the retained `ByteBuf` reference and the stale parser state continuation.\n\n## Technical Details\n\n`RedisArrayAggregator.decode(...)` retains non-array messages before adding them to `depths.peek().children`. In `decodeRedisArrayHeader(...)`, the `header.length() \u003e maxElements` branch throws immediately:\n\n```java\nif (header.length() \u003e maxElements) {\n    throw new CodecException(\"this codec doesn't support longer length than \" + maxElements);\n}\n```\n\nThe immediately following nested-depth branch clears retained aggregate state before throwing:\n\n```java\nif (depths.size() \u003e= maxNestedArrayDepth) {\n    releaseAndClearDepths();\n    throw new CodecException(\"max nested array depth exceeded: \" + maxNestedArrayDepth);\n}\n```\n\nThe missing cleanup in the first branch leaves retained children and aggregate state reachable after the exception.\n\n## PoC\n\nPlace the supplied `RedisArrayAggregatorIncompleteCleanupPovTest.java` under:\n\n`codec-redis/src/test/java/io/netty/handler/codec/redis/`\n\nRun:\n\n```fish\n./mvnw -pl codec-redis -am -Dtest=RedisArrayAggregatorIncompleteCleanupPovTest -Dsurefire.failIfNoSpecifiedTests=false -DskipNativeTests -DskipAutobahnTests test\n```\n\nThe test suite includes:\n\n- serialized RESP trigger through `RedisDecoder`, `RedisBulkStringAggregator`, and `RedisArrayAggregator`;\n- direct refcount proof that max-elements overflow does not release the retained child immediately;\n- post-exception continuation proof that the stale aggregate consumes a later message;\n- nested-depth controls that clear the same partial aggregate state.\n\nAll five tests pass on current `4.2`, `4.2.15.Final`, and `4.1.135.Final`.\n\n## Impact\n\nFor Redis codec pipelines that continue after codec exceptions, an unauthenticated peer can keep attacker-controlled aggregate state alive across a security-limit exception. This can pin retained pooled buffers until channel close/removal or until a later message completes the stale aggregate.\n\n`RedisBulkStringAggregator` permits bulk strings up to `RedisConstants.REDIS_MESSAGE_MAX_LENGTH` (`512MB`), so the retained child can be large in deployments that aggregate untrusted Redis streams.\n\nApplications that always close the channel or remove the handler on decoder exceptions will trigger existing cleanup; the issue is the missing immediate cleanup on the max-elements failure path while the handler remains installed.\n\n## Suggested Fix\n\nCall `releaseAndClearDepths()` before throwing from the max-elements branch. Consider applying the same cleanup to all unrecoverable `decodeRedisArrayHeader(...)` error exits that can occur while `depths` is non-empty.\n\n## Affected Package/Versions\n\n`io.netty:netty-codec-redis`\n\nConfirmed on:\n\n- current `4.2` branch head `7bae566a93e69409697fe57fa807910ba5c9720e`\n- `4.2.15.Final` at `a41f7b289ce1`\n- `4.1.135.Final` at `f05f765d8146`\n\n## Advisory History\n\nThis differs from the public Redis codec advisories because it reproduces on their patched tags:\n\n- `GHSA-5w86-c3rq-vjj7`\n- `GHSA-3244-j874-rhc2` / `CVE-2026-44250`\n- `GHSA-6jv9-x5w9-2ccm` / `CVE-2026-48006`\n- `GHSA-6ghj-frrj-jjj3` / `CVE-2026-44890`\n\n## Why This Is Not Intended Behavior\n\nThe public API docs document `RedisArrayAggregator` as aggregating `RedisMessage` parts into `ArrayRedisMessage` and document a `CodecException` when an array header exceeds `maxElements`. They do not document preserving pre-exception partial aggregate state after that limit fires.\n\nThe adjacent nested-depth branch already calls `releaseAndClearDepths()` before throwing. The max-elements branch is the sibling aggregation-limit branch but throws without cleanup. Netty's later Redis lifecycle cleanup patch explicitly added release behavior for nested-array failure and handler removal, leaving the max-elements failure branch as a missed cleanup path.","status":"published","published":"2026-08-07T17:16:13Z","modified":"2026-09-10T03:50:53.885781754Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-401","CWE-703"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"GHSA-xpw8-rcwv-8f8p","title":"io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack","description":"A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. \n\n### Impact\nThis is a DDOS attack, any http2 server is affected and so you should update as soon as possible.\n\n### Patches\nThis is patched in version 4.1.100.Final.\n\n### Workarounds\nA user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own `Http2FrameListener` implementation or an `ChannelInboundHandler` implementation (depending which http2 API is used).\n\n### References\n- https://www.cve.org/CVERecord?id=CVE-2023-44487\n- https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/\n- https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps/","status":"published","published":"2023-10-10T22:22:54Z","modified":"2026-09-10T03:49:58.76078733Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:47:00.198893Z"},{"id":"RHLW-2026-6f1a404174e2316f","title":"Lightwell Security Advisory: netty-codec-redis 4.1.100.Final-rhlw-00001","description":"Red Hat Lightwell has released io.netty:netty-codec-redis 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2026-42586, CVE-2026-44250, CVE-2026-44890, CVE-2026-48006, CVE-2026-50011, and CVE-2026-56818.\n\nCVE-2026-42586: Netty: CRLF Injection in Netty Redis Codec Encoder\n\nCVE-2026-44250: Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays\n\nCVE-2026-44890: Netty has Unbounded Direct Memory Consumption in its RedisDecoder\n\nCVE-2026-48006: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator\n\nCVE-2026-50011: Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length\n\nCVE-2026-56818: Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state\n\nThis patched artifact is a drop-in replacement for io.netty:netty-codec-redis 4.1.100.Final from Maven Central.","status":"published","published":"2026-10-12T16:57:49Z","modified":"2026-10-27T04:13:03.22676867Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-GHSA-xpw8-rcwv-8f8p","title":"GHSA-xpw8-rcwv-8f8p in io.root.io.netty:netty-codec-http2 - Patched by Root","description":"Root has patched GHSA-xpw8-rcwv-8f8p in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-06-18T12:52:23Z","modified":"2026-06-18T18:15:26.175069727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2026-56818","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","status":"published","published":"2026-08-07T18:17:00Z","modified":"2026-10-17T12:59:10.601587042Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"CLSA-2026-1787045999","title":"TuxCare security update for io.netty (23 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.135.Final-tuxcare.1.","status":"published","published":"2026-08-18T09:39:59Z","modified":"2026-10-15T09:46:22.118386744Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787049848","title":"TuxCare security update for io.netty (23 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 23 CVEs. Fixed in 4.1.130.Final-tuxcare.3.","status":"published","published":"2026-08-18T10:44:08Z","modified":"2026-10-15T09:46:35.670728434Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787271464","title":"TuxCare security update for io.netty (59 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 59 CVEs. Fixed in 4.1.122.Final-tuxcare.2.","status":"published","published":"2026-08-21T00:17:44Z","modified":"2026-10-15T09:46:34.75643555Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787301097","title":"TuxCare security update for io.netty (60 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 60 CVEs. Fixed in 4.1.119.Final-tuxcare.1.","status":"published","published":"2026-08-21T08:31:37Z","modified":"2026-10-15T09:46:34.967537233Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787306632","title":"TuxCare security update for io.netty (41 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 41 CVEs. Fixed in 4.1.112.Final-tuxcare.6.","status":"published","published":"2026-08-21T10:03:52Z","modified":"2026-10-15T09:46:35.351743786Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787309634","title":"TuxCare security update for io.netty (62 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1.","status":"published","published":"2026-08-21T10:53:54Z","modified":"2026-10-15T09:46:34.370885626Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787331164","title":"TuxCare security update for io.netty (48 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 48 CVEs. Fixed in 4.1.117.Final-tuxcare.3.","status":"published","published":"2026-08-21T16:52:44Z","modified":"2026-10-15T09:47:25.558975504Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787333890","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.108.Final-tuxcare.1.","status":"published","published":"2026-08-21T17:38:10Z","modified":"2026-10-15T09:47:25.399673043Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787383378","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.107.Final-tuxcare.1.","status":"published","published":"2026-08-22T07:22:58Z","modified":"2026-10-15T09:47:25.582500226Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787397404","title":"TuxCare security update for io.netty (61 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 61 CVEs. Fixed in 4.1.94.Final-tuxcare.1.","status":"published","published":"2026-08-22T11:16:44Z","modified":"2026-11-10T19:58:30.506519107Z","updated_at":"2026-11-10T20:07:15.512362Z"},{"id":"CLSA-2026-1787671732","title":"TuxCare security update for io.netty (14 CVEs)","description":"TuxCare rebuilt 47 io.netty packages to address 14 CVEs. Fixed in 4.1.115.Final-tuxcare.8.","status":"published","published":"2026-08-25T15:28:52Z","modified":"2026-10-15T09:47:33.367099755Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789379074","title":"TuxCare security update for io.netty (22 CVEs)","description":"TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4.","status":"published","published":"2026-09-14T09:44:34Z","modified":"2026-10-15T09:47:43.074218723Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"openSUSE-SU-2026:11394-1","title":"netty-4.1.136-1.1 on GA media","description":"These are all security issues fixed in the netty-4.1.136-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-28T00:00:00Z","modified":"2026-07-29T18:24:26.986451317Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"SUSE-SU-2026:3482-1","title":"Security update for netty, netty-tcnative","description":"This update for netty, netty-tcnative fixes the following issues:\n\nUpgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.\n\nSecurity issues fixed\n\n- CVE-2026-44891: memory exhaustion in `io.netty:netty-codec-stomp` (bsc#1271435).\n- CVE-2026-55831: resource exhaustion/DoS in `io.netty:netty-codec-http` (bsc#1271960).\n- CVE-2026-55833: zip bomb in `io.netty:netty-codec-http` (bsc#1271961).\n- CVE-2026-55851: memory exhaustion in `io.netty:netty-codec-haproxy` (bsc#1272253).\n- CVE-2026-56745: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272254).\n- CVE-2026-56746: improper access control in `io.netty:netty-codec-http` (CORS) (bsc#1272255).\n- CVE-2026-56817: insecure defaults in XML parsing in `io.netty:netty-codec-xml` (bsc#1272257).\n- CVE-2026-56818: memory leak in `io.netty:netty-codec-redis` (bsc#1272603).\n- CVE-2026-56819: memory leak in `io.netty:netty-codec-http2` (bsc#1272258).\n- CVE-2026-56820: improper certificate validation in `io.netty:netty-handler-ssl-ocsp` (bsc#1272259).\n- CVE-2026-56821: improper certificate revocation check in `io.netty:netty-handler-ssl-ocsp` (bsc#1272299).\n- CVE-2026-56822: time-of-check/time-of-use in `io.netty:netty-handler-ssl-ocsp` (bsc#1272300).\n- CVE-2026-59898: protocol version confusion in `io.netty:netty-codec-http` (websocket) (bsc#1272302).\n- CVE-2026-59899: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272301).\n- CVE-2026-59900: improper header neutralization in `io.netty:netty-codec-http2` (bsc#1272303).\n- CVE-2026-59901: infinite loop in `io.netty:netty-codec-compression` (bzip2) (bsc#1272304).\n- CVE-2026-59919: improper CR/LF neutralization in `io.netty:netty-codec-haproxy` (bsc#1272305).\n- CVE-2026-59920: improper CR/LF neutrolization in `io.netty:netty-codec-stomp` (bsc#1272306).\n- CVE-2026-59921: improper CR/LF neutralization in `io.netty:netty-codec-http` (multipart) (bsc#1272307).\n- Memory leak in `io.netty:netty-codec-dns`  (bsc#1272519).\n- Uncontrolled resource consumption in `io.netty:netty-codec-xml` (bsc#1272518).\n\nOther updates and bugfixes:\n\n- Upgrade to upstream version 4.1.136:\n  + SingleThreadEventExecutor: document Throwable safety contract\n    on run()\n  + Make HTTP/2 frame hashCode consistent with equals\n  + Add BlockHound exception for DnsQueryIdSpace (#16896)\n  + FlowControlHandler: Fix autoRead behavior\n  + Fix incorrect bounds in error message of\n    HpackDecoder.setMaxHeaderListSize\n  + MQTT: Fix MQTT decoder size check after variable header replay\n  + MQTT: Make the decodeProperties early-REPLAY check actually\n    fire\n  + Reject control characters at the boundary of HTTP method names\n    (#16723)\n  + Update to latest tcnative release\n  + Fix HTTP 2 PUSH_PROMISE stream association validation\n  + Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder\n  + Add opt-in validation of mandatory pseudo-header fields for\n    HTTP/2\n  + Strictly validate MQTT UTF-8 Encoded String (#16939)\n  + Stop DateFormatter trailing token from running past the parse\n    end\n  + IpFilter: Deprecate constructor which use accept by default\n  + Add RFC 10008 QUERY Method support (#16966)\n  + Correctly release and fail queued traffic-shaping writes on\n    close (#16959)\n  + FlowControlHandler: respect auto-read when toggled while\n    dequeueing\n  + IdleStateHandler: reset firstWriter/ReaderIdleEvent in\n    resetWriteTimeout/resetReadTimeout (#16982)\n  + Fix typo in AbstractSniHandler Javadoc\n  + Reconcile AbstractCoalescingBufferQueue readableBytes when it\n    drains, and fail stuck HTTP/2 streams instead of spinning\n    empty DATA frames\n  + Reject control characters at the boundary of the HTTP version\n    token (#16971)\n  + Reset UTF-8 decode state on CR in StompSubframeDecoder\n  + HTTP2: Pass the correct number of arguments when logging\n    goaway\n  + FastLz: Guard decompression against truncated input (#17000)\n  + Fix propagation of startTls for client SslContext handler\n  + Reject non-token characters in HTTP/2 header names\n  + Update lz4-java to 1.11.1\n  + Pin github actions to reduce risk (#17043)\n  + Merge branches from forks (#17063)\n","status":"published","published":"2026-08-04T11:46:42Z","modified":"2026-08-05T18:23:51.045558593Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}