{"id":"CVE-2026-75595","aliases":["CLSA-2026-1789214678","CLSA-2026-1789228568","CLSA-2026-1790858840","CLSA-2026-1792115780","CLSA-2026-1792686278","CLSA-2026-1792686520","CLSA-2026-1792693038","DEBIAN-CVE-2026-75595","EUVD-2026-63095","GHSA-3qp7-7mw8-wx86","GHSA-4g8c-wm8x-jfhw","GHSA-c4c3-7fpv-j4q5","GHSA-c653-97m9-rcg9","GHSA-fccg-mwvh-qqg4","GHSA-x4gw-5cx5-pgmh","RHLW-2026-313117b0cad7329e","ROOT-APP-MAVEN-CVE-2026-75595","SUSE-SU-2026:4391-1","UBUNTU-CVE-2026-75595","openSUSE-SU-2026:11882-1"],"status":"published","title":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","severity":{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00316,"percentile":0.24791,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-475","CWE-754"],"published":"2026-08-19T21:00:27Z","modified":"2026-11-02T19:46:31Z","fixes":[{"ecosystem":"Maven","package":"io.netty:netty-handler","fixed_in":["4.2.17.Final","4.1.137.Final"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","fixed_in":["4.1.108.Final-tuxcare.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.netty:netty-handler","fixed_in":["4.1.126.Final-aikido.24","4.1.118.Final-aikido.25","4.1.119.Final-aikido.9","4.1.135.Final-aikido.1","4.1.118.Final-aikido.26","4.1.119.Final-aikido.10","4.1.136.Final-aikido.1","4.2.16.Final-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.io.netty:netty-handler","fixed_in":["4.1.126.Final-root.io.24","4.1.118.Final-root.io.25","4.1.119.Final-root.io.9","4.1.135.Final-root.io.1","4.1.118.Final-root.io.26","4.1.119.Final-root.io.10","4.1.136.Final-root.io.1","4.2.16.Final-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"last_affected":"4.2.16.Final"},{"fixed":"4.2.17.Final"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.136.Final"},{"fixed":"4.1.137.Final"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.122.Final"},{"fixed":"4.1.122.Final-tuxcare.4"}]}],"versions":["4.1.122.Final","4.1.122.Final-tuxcare.1","4.1.122.Final-tuxcare.2","4.1.122.Final-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.119.Final"},{"fixed":"4.1.119.Final-tuxcare.3"}]}],"versions":["4.1.119.Final","4.1.119.Final-tuxcare.1","4.1.119.Final-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.108.Final"},{"fixed":"4.1.108.Final-tuxcare.3"}]}],"versions":["4.1.108.Final","4.1.108.Final-tuxcare.1","4.1.108.Final-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.115.Final"},{"fixed":"4.1.115.Final-tuxcare.9"}]}],"versions":["4.1.115.Final","4.1.115.Final-tuxcare.1","4.1.115.Final-tuxcare.3","4.1.115.Final-tuxcare.4","4.1.115.Final-tuxcare.5","4.1.115.Final-tuxcare.6","4.1.115.Final-tuxcare.7","4.1.115.Final-tuxcare.8"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-classes-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.118.Final"},{"fixed":"4.1.118.Final-tuxcare.1"}]}],"versions":["4.1.118.Final"],"bundled":26},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-resolver-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-sctp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.114.Final"},{"fixed":"4.1.114.Final-tuxcare.1"}]}],"versions":["4.1.114.Final"],"bundled":24},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-http2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-mqtt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-smtp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-codec-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-epoll","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.netty:netty-transport-native-kqueue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.113.Final"},{"fixed":"4.1.113.Final-tuxcare.1"}]}],"versions":["4.1.113.Final"],"bundled":15},{"source":"osv","ecosystem":"Debian:12","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16","1:4.1.48-7","1:4.1.48-7+deb12u1","1:4.1.48-7+deb12u2","1:4.1.48-8","1:4.1.48-9"]},{"source":"osv","ecosystem":"Debian:13","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-10+deb13u1","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Debian:14","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-15","1:4.1.48-16"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0.Final"},{"fixed":"4.2.17.Final"}]}],"versions":["4.2.0.Final","4.2.1.Final","4.2.10.Final","4.2.11.Final","4.2.12.Final","4.2.13.Final","4.2.14.Final","4.2.15.Final","4.2.16.Final","4.2.2.Final","4.2.3.Final","4.2.4.Final","4.2.5.Final","4.2.6.Final","4.2.7.Final","4.2.8.Final","4.2.9.Final"]},{"source":"osv","ecosystem":"Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.137.Final"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.101.Final","4.1.102.Final","4.1.103.Final","4.1.104.Final","4.1.105.Final","4.1.106.Final","4.1.107.Final","4.1.108.Final","4.1.109.Final","4.1.11.Final","4.1.110.Final","4.1.111.Final","4.1.112.Final","4.1.113.Final","4.1.114.Final","4.1.115.Final","4.1.116.Final","4.1.117.Final","4.1.118.Final","4.1.119.Final","4.1.12.Final","4.1.120.Final","4.1.121.Final","4.1.122.Final","4.1.123.Final","4.1.124.Final","4.1.125.Final","4.1.126.Final","4.1.127.Final","4.1.128.Final","4.1.129.Final","4.1.13.Final","4.1.130.Final","4.1.131.Final","4.1.132.Final","4.1.133.Final","4.1.134.Final","4.1.135.Final","4.1.136.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.100.Final-rhlw-00001"}]}],"versions":["4.0.0.Alpha1","4.0.0.Alpha2","4.0.0.Alpha3","4.0.0.Alpha4","4.0.0.Alpha5","4.0.0.Alpha6","4.0.0.Alpha7","4.0.0.Alpha8","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.CR1","4.0.0.CR2","4.0.0.CR3","4.0.0.CR4","4.0.0.CR5","4.0.0.CR6","4.0.0.CR7","4.0.0.CR8","4.0.0.CR9","4.0.0.Final","4.0.1.Final","4.0.10.Final","4.0.11.Final","4.0.12.Final","4.0.13.Final","4.0.14.Beta1","4.0.14.Final","4.0.15.Final","4.0.16.Final","4.0.17.Final","4.0.18.Final","4.0.19.Final","4.0.2.Final","4.0.20.Final","4.0.21.Final","4.0.22.Final","4.0.23.Final","4.0.24.Final","4.0.25.Final","4.0.26.Final","4.0.27.Final","4.0.28.Final","4.0.29.Final","4.0.3.Final","4.0.30.Final","4.0.31.Final","4.0.32.Final","4.0.33.Final","4.0.34.Final","4.0.35.Final","4.0.36.Final","4.0.37.Final","4.0.38.Final","4.0.39.Final","4.0.4.Final","4.0.40.Final","4.0.41.Final","4.0.42.Final","4.0.43.Final","4.0.44.Final","4.0.45.Final","4.0.46.Final","4.0.47.Final","4.0.48.Final","4.0.49.Final","4.0.5.Final","4.0.50.Final","4.0.51.Final","4.0.52.Final","4.0.53.Final","4.0.54.Final","4.0.55.Final","4.0.56.Final","4.0.6.Final","4.0.7.Final","4.0.8.Final","4.0.9.Final","4.1.0.Beta1","4.1.0.Beta2","4.1.0.Beta3","4.1.0.Beta4","4.1.0.Beta5","4.1.0.Beta6","4.1.0.Beta7","4.1.0.Beta8","4.1.0.CR1","4.1.0.CR2","4.1.0.CR3","4.1.0.CR4","4.1.0.CR5","4.1.0.CR6","4.1.0.CR7","4.1.0.Final","4.1.1.Final","4.1.10.Final","4.1.100.Final","4.1.11.Final","4.1.12.Final","4.1.13.Final","4.1.14.Final","4.1.15.Final","4.1.16.Final","4.1.17.Final","4.1.18.Final","4.1.19.Final","4.1.2.Final","4.1.20.Final","4.1.21.Final","4.1.22.Final","4.1.23.Final","4.1.24.Final","4.1.25.Final","4.1.26.Final","4.1.27.Final","4.1.28.Final","4.1.29.Final","4.1.3.Final","4.1.30.Final","4.1.31.Final","4.1.32.Final","4.1.33.Final","4.1.34.Final","4.1.35.Final","4.1.36.Final","4.1.37.Final","4.1.38.Final","4.1.39.Final","4.1.4.Final","4.1.40.Final","4.1.41.Final","4.1.42.Final","4.1.43.Final","4.1.44.Final","4.1.45.Final","4.1.46.Final","4.1.47.Final","4.1.48.Final","4.1.49.Final","4.1.5.Final","4.1.50.Final","4.1.51.Final","4.1.52.Final","4.1.53.Final","4.1.54.Final","4.1.55.Final","4.1.56.Final","4.1.57.Final","4.1.58.Final","4.1.59.Final","4.1.6.Final","4.1.60.Final","4.1.61.Final","4.1.62.Final","4.1.63.Final","4.1.64.Final","4.1.65.Final","4.1.66.Final","4.1.67.Final","4.1.68.Final","4.1.69.Final","4.1.7.Final","4.1.70.Final","4.1.71.Final","4.1.72.Final","4.1.73.Final","4.1.74.Final","4.1.75.Final","4.1.76.Final","4.1.77.Final","4.1.78.Final","4.1.79.Final","4.1.8.Final","4.1.80.Final","4.1.81.Final","4.1.82.Final","4.1.83.Final","4.1.84.Final","4.1.85.Final","4.1.86.Final","4.1.87.Final","4.1.88.Final","4.1.89.Final","4.1.9.Final","4.1.90.Final","4.1.91.Final","4.1.92.Final","4.1.93.Final","4.1.94.Final","4.1.95.Final","4.1.96.Final","4.1.97.Final","4.1.98.Final","4.1.99.Final"],"bundled":6},{"source":"osv","ecosystem":"Root:Maven","package":"io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.126.Final-aikido.24"},{"fixed":"4.1.118.Final-aikido.25"},{"fixed":"4.1.119.Final-aikido.9"},{"fixed":"4.1.135.Final-aikido.1"},{"fixed":"4.1.118.Final-aikido.26"},{"fixed":"4.1.119.Final-aikido.10"},{"fixed":"4.1.136.Final-aikido.1"},{"fixed":"4.2.16.Final-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.io.netty:netty-handler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.126.Final-root.io.24"},{"fixed":"4.1.118.Final-root.io.25"},{"fixed":"4.1.119.Final-root.io.9"},{"fixed":"4.1.135.Final-root.io.1"},{"fixed":"4.1.118.Final-root.io.26"},{"fixed":"4.1.119.Final-root.io.10"},{"fixed":"4.1.136.Final-root.io.1"},{"fixed":"4.2.16.Final-root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.138-150200.4.56.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"netty-tcnative","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.84-150200.3.51.1"}]}],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1","1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:3.2.6.Final-2","1:4.0.32-1","1:4.0.33-1","1:4.0.34-1","1:4.0.34-1ubuntu0.1~esm1","1:4.0.34-1ubuntu0.1~esm2","1:4.0.34-1ubuntu0.1~esm3","1:4.0.34-1ubuntu0.1~esm4","1:4.0.34-1ubuntu0.1~esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1","1:4.1.7-4ubuntu0.1+esm1","1:4.1.7-4ubuntu0.1+esm2","1:4.1.7-4ubuntu0.1+esm3","1:4.1.7-4ubuntu0.1+esm4","1:4.1.7-4ubuntu0.1+esm5","1:4.1.7-4ubuntu0.1+esm6","1:4.1.7-4ubuntu0.1+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.33-1","1:4.1.33-2","1:4.1.33-3","1:4.1.45-1","1:4.1.45-1ubuntu0.1~esm1","1:4.1.45-1ubuntu0.1~esm2","1:4.1.45-1ubuntu0.1~esm3","1:4.1.45-1ubuntu0.1~esm4","1:4.1.45-1ubuntu0.1~esm6","1:4.1.45-1ubuntu0.1~esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-4","1:4.1.48-4+deb11u1build0.22.04.1","1:4.1.48-4+deb11u2build0.22.04.1","1:4.1.48-4+deb11u2ubuntu0.1~esm1","1:4.1.48-4+deb11u2ubuntu0.1~esm2","1:4.1.48-4+deb11u2ubuntu0.1","1:4.1.48-4+deb11u2ubuntu0.1+esm1","1:4.1.48-4+deb11u2ubuntu0.1+esm3","1:4.1.48-4+deb11u2ubuntu0.2","1:4.1.48-4+deb11u2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-7","1:4.1.48-8","1:4.1.48-9","1:4.1.48-9ubuntu0.1~esm1","1:4.1.48-9ubuntu0.1~esm2","1:4.1.48-9ubuntu0.1","1:4.1.48-9ubuntu0.1+esm1","1:4.1.48-9ubuntu0.1+esm3","1:4.1.48-9ubuntu0.2","1:4.1.48-9ubuntu0.2+esm1","1:4.1.48-9ubuntu0.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-16","1:4.1.48-16ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:4.1.48-10","1:4.1.48-11","1:4.1.48-12","1:4.1.48-13","1:4.1.48-14","1:4.1.48-16","1:4.1.48-16ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.138-1.1"}]}],"bundled":30}],"products":[{"vendor":"netty","product":"netty"}],"references":[{"url":"https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/netty/netty/pull/17213","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/netty/netty/pull/17217","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.137.Final","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.17.Final","tags":["x_refsource_MISC","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75595","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c4c3-7fpv-j4q5","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75595.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-75595","tags":["advisory"]},{"url":"https://github.com/netty/netty","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24970.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24970","tags":["advisory"]},{"url":"https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-4g8c-wm8x-jfhw","tags":["advisory"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final","tags":["web"]},{"url":"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final","tags":["web"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26017","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26018","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26586","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28573","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:34608","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36820","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:37390","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48124","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49700","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:49701","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50085","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53644","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53645","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:53646","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:65126","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-44249","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44249.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44249","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3qp7-7mw8-wx86","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62260","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45416","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45416.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45416","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x4gw-5cx5-pgmh","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-50010","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50010.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50010","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c653-97m9-rcg9","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75596.json","tags":["advisory"]},{"url":"https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4","tags":["advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75596","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fccg-mwvh-qqg4","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264391-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275500","tags":["report"]},{"url":"https://bugzilla.suse.com/1275501","tags":["report"]},{"url":"https://bugzilla.suse.com/1276420","tags":["report"]},{"url":"https://bugzilla.suse.com/1276421","tags":["report"]},{"url":"https://bugzilla.suse.com/1276455","tags":["report"]},{"url":"https://bugzilla.suse.com/1276456","tags":["report"]},{"url":"https://bugzilla.suse.com/1277243","tags":["report"]},{"url":"https://bugzilla.suse.com/1280048","tags":["report"]},{"url":"https://bugzilla.suse.com/1281431","tags":["report"]},{"url":"https://bugzilla.suse.com/1281432","tags":["report"]},{"url":"https://bugzilla.suse.com/1281433","tags":["report"]},{"url":"https://bugzilla.suse.com/1281434","tags":["report"]},{"url":"https://bugzilla.suse.com/1281435","tags":["report"]},{"url":"https://bugzilla.suse.com/1282084","tags":["report"]},{"url":"https://bugzilla.suse.com/1282085","tags":["report"]},{"url":"https://bugzilla.suse.com/1282132","tags":["report"]},{"url":"https://bugzilla.suse.com/1282140","tags":["report"]},{"url":"https://bugzilla.suse.com/1282141","tags":["report"]},{"url":"https://bugzilla.suse.com/1282362","tags":["report"]},{"url":"https://bugzilla.suse.com/1282363","tags":["report"]},{"url":"https://bugzilla.suse.com/1282364","tags":["report"]},{"url":"https://bugzilla.suse.com/1282366","tags":["report"]},{"url":"https://bugzilla.suse.com/1282367","tags":["report"]},{"url":"https://bugzilla.suse.com/1282370","tags":["report"]},{"url":"https://bugzilla.suse.com/1282372","tags":["report"]},{"url":"https://bugzilla.suse.com/1282373","tags":["report"]},{"url":"https://bugzilla.suse.com/1282374","tags":["report"]},{"url":"https://bugzilla.suse.com/1282378","tags":["report"]},{"url":"https://bugzilla.suse.com/1282506","tags":["report"]},{"url":"https://bugzilla.suse.com/1282507","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62243","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75595","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-75596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-76816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89044","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93568","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93573","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93579","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-75595","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75595","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-75595","title":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T21:00:27.627Z","modified":"2026-08-20T14:06:16.963Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-63095","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T21:00:27Z","modified":"2026-08-20T14:06:16Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:01:40.451894Z"}],"ghsa":[{"id":"GHSA-c4c3-7fpv-j4q5","title":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext","description":"### Summary\nA fragmented TLS ClientHello whose handshake header spans multiple records makes Netty silently fall back to the default SslContext; where per-SNI selection is the sole mTLS gate, an unauthenticated attacker can bypass the route's mTLS requirement.\n\n### Details\nIn `io.netty.handler.ssl.SslClientHelloHandler#decode` the guard that should wait for the 4-byte handshake header checks the wrong offset - it ignores the 5-byte record header that precedes it - and therefore never fires:\n\n```java\nif (handshakeLength == -1) {\n    if (readerIndex + 4 \u003e endOffset) {\n        // Need more data to read HandshakeType and handshakeLength (4 bytes)\n        return;\n    }\n```\n\nWhen the first record's payload is \u003c 4 bytes, `handshakeLength = in.getUnsignedMedium(readerIndex + SslUtils.SSL_RECORD_HEADER_LENGTH + 1);` leads to `IndexOutOfBoundsException `. That is caught by the generic `catch (Exception)` block, which calls `select(ctx, null)` - this is the default `SslContext`. Fallback to default on parse failure is a problem when per-SNI selection is the sole mTLS gate.\n\n### Impact\nSNI routing bypass. Escalates to an unauthenticated mTLS bypass only when:\n- mTLS is enforced solely via per-SNI SslContext (clientAuth=REQUIRE)\n- the default/fallback SslContext is permissive (clientAuth=NONE/OPTIONAL)\n- no secondary peer-certificate verification exists at the application layer.","status":"published","published":"2026-09-08T18:16:14Z","modified":"2026-09-08T18:16:15Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-475","CWE-754"],"updated_at":"2026-11-02T14:41:13.477974Z"}],"nvd":[{"id":"CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T21:17:37.563Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T14:12:39.962615Z"}],"osv":[{"id":"CVE-2026-75595","title":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T21:00:27.627Z","modified":"2026-10-28T11:17:45.70874289Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-754"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T21:17:37.563Z","modified":"2026-10-27T09:47:39.173826795Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:46:03.004924Z"},{"id":"GHSA-c4c3-7fpv-j4q5","title":"Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext","description":"### Summary\nA fragmented TLS ClientHello whose handshake header spans multiple records makes Netty silently fall back to the default SslContext; where per-SNI selection is the sole mTLS gate, an unauthenticated attacker can bypass the route's mTLS requirement.\n\n### Details\nIn `io.netty.handler.ssl.SslClientHelloHandler#decode` the guard that should wait for the 4-byte handshake header checks the wrong offset - it ignores the 5-byte record header that precedes it - and therefore never fires:\n\n```java\nif (handshakeLength == -1) {\n    if (readerIndex + 4 \u003e endOffset) {\n        // Need more data to read HandshakeType and handshakeLength (4 bytes)\n        return;\n    }\n```\n\nWhen the first record's payload is \u003c 4 bytes, `handshakeLength = in.getUnsignedMedium(readerIndex + SslUtils.SSL_RECORD_HEADER_LENGTH + 1);` leads to `IndexOutOfBoundsException `. That is caught by the generic `catch (Exception)` block, which calls `select(ctx, null)` - this is the default `SslContext`. Fallback to default on parse failure is a problem when per-SNI selection is the sole mTLS gate.\n\n### Impact\nSNI routing bypass. Escalates to an unauthenticated mTLS bypass only when:\n- mTLS is enforced solely via per-SNI SslContext (clientAuth=REQUIRE)\n- the default/fallback SslContext is permissive (clientAuth=NONE/OPTIONAL)\n- no secondary peer-certificate verification exists at the application layer.","status":"published","published":"2026-09-08T18:16:14Z","modified":"2026-09-08T18:27:48.571082951Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-475","CWE-754"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"RHLW-2026-313117b0cad7329e","title":"Lightwell Security Advisory: netty-handler 4.1.100.Final-rhlw-00001","description":"Red Hat Lightwell has released io.netty:netty-handler 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-24970, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-75595, and CVE-2026-75596.\n\nCVE-2025-24970: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine\n\nCVE-2026-44249: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking\n\nCVE-2026-45416: Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes\n\nCVE-2026-50010: Netty's wrapping plain trust manager silently disables hostname verification\n\nCVE-2026-75595: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext\n\nCVE-2026-75596: Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing\n\nThis patched artifact is a drop-in replacement for io.netty:netty-handler 4.1.100.Final from Maven Central.","status":"published","published":"2026-10-12T16:58:10Z","modified":"2026-10-27T04:13:04.191727203Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-75595","description":"Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.","status":"published","published":"2026-08-19T21:17:00Z","modified":"2026-10-17T13:01:05.68671432Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"CLSA-2026-1789214678","title":"TuxCare security update for io.netty:netty-handler (2 CVEs)","description":"TuxCare rebuilt io.netty:netty-handler to address 2 CVEs. Fixed in 4.1.122.Final-tuxcare.4.","status":"published","published":"2026-09-12T12:04:38Z","modified":"2026-11-02T19:46:14.33536631Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1789228568","title":"TuxCare security update for io.netty:netty-handler (2 CVEs)","description":"TuxCare rebuilt io.netty:netty-handler to address 2 CVEs. Fixed in 4.1.119.Final-tuxcare.3.","status":"published","published":"2026-09-12T15:56:08Z","modified":"2026-11-02T19:46:14.340218921Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1790858840","title":"TuxCare security update for io.netty:netty-handler (1 CVE)","description":"TuxCare rebuilt io.netty:netty-handler to address 1 CVE. Fixed in 4.1.108.Final-tuxcare.3.","status":"published","published":"2026-10-01T12:47:20Z","modified":"2026-11-02T19:46:23.443276945Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1792115780","title":"TuxCare security update for io.netty (9 CVEs)","description":"TuxCare rebuilt 8 io.netty packages to address 9 CVEs. Fixed in 4.1.115.Final-tuxcare.9.","status":"published","published":"2026-10-16T01:56:20Z","modified":"2026-11-02T19:46:29.392948514Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792686278","title":"TuxCare security update for io.netty (26 CVEs)","description":"TuxCare rebuilt 14 io.netty packages to address 26 CVEs. Fixed in 4.1.118.Final-tuxcare.1.","status":"published","published":"2026-10-22T16:24:38Z","modified":"2026-11-02T19:46:30.467301233Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792686520","title":"TuxCare security update for io.netty (24 CVEs)","description":"TuxCare rebuilt 13 io.netty packages to address 24 CVEs. Fixed in 4.1.114.Final-tuxcare.1.","status":"published","published":"2026-10-22T16:28:40Z","modified":"2026-11-02T19:46:30.908225231Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792693038","title":"TuxCare security update for io.netty (15 CVEs)","description":"TuxCare rebuilt 10 io.netty packages to address 15 CVEs. Fixed in 4.1.113.Final-tuxcare.1.","status":"published","published":"2026-10-22T18:17:18Z","modified":"2026-11-02T19:46:31.127817858Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"openSUSE-SU-2026:11882-1","title":"netty-4.1.138-1.1 on GA media","description":"These are all security issues fixed in the netty-4.1.138-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-09-24T00:00:00Z","modified":"2026-09-25T18:23:09.573141425Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-75595","title":"CVE-2026-75595 in io.netty:netty-handler - Patched by Root","description":"Root has patched CVE-2026-75595 in the io.netty:netty-handler package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-30T12:24:51Z","modified":"2026-10-30T13:15:03.410446432Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"SUSE-SU-2026:4391-1","title":"Security update for netty, netty-tcnative","description":"This update for netty, netty-tcnative fixes the following issues:\n\n- CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501).\n- CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite\n  (bsc#1275500).\n- CVE-2026-62243: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455).\n- CVE-2026-62380: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456).\n- CVE-2026-75595: fragmented TLS `ClientHello` causes fallback to default `SslContext` and allows for SNI routing and\n  mTLS requirement bypass (bsc#1276420).\n- CVE-2026-75596: fragmented `ClientHello`records can trigger quadratic pre-handshake reassembly in default SNI parsing\n  (bsc#1276421).\n- CVE-2026-76816: missing input validation in `MqttEncoder` allows for null-byte injection, topic hijacking, and ACL\n  bypassing (bsc#1277243).\n- CVE-2026-89044: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding\n  (bsc#1280048).\n- CVE-2026-93488: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084).\n- CVE-2026-93491: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085).\n- CVE-2026-93492: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132).\n- CVE-2026-93493: missing `nextUpdate` field in OCSP responses leads to silent validation bypass (bsc#1281431).\n- CVE-2026-93494: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506).\n- CVE-2026-93558: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service\n  (bsc#1282140).\n- CVE-2026-93560: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141).\n- CVE-2026-93562: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362).\n- CVE-2026-93563: unbounded multi-line response accumulation in `SmtpResponseDecoder` leads to memory exhaustion and a\n  DoS (bsc#1281432).\n- CVE-2026-93564: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363).\n- CVE-2026-93565: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364).\n- CVE-2026-93566: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366).\n- CVE-2026-93567: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled\n  :authority (bsc#1282367).\n- CVE-2026-93568: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370).\n- CVE-2026-93569: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target\n  authority (bsc#1282372).\n- CVE-2026-93572: multiplication of patched preallocation limits in `RedisArrayAggregator` nested RESP headers can lead\n  to denial of service (bsc#1281433).\n- CVE-2026-93573: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373).\n- CVE-2026-93574: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374).\n- CVE-2026-93575: missing validations in the `MqttDecoder` can lead to excessive resource consumption and a DoS\n  (bsc#1281434).\n- CVE-2026-93576: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507).\n- CVE-2026-93578: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass\n  (bsc#1281435).\n- CVE-2026-93579: HTTP/2 header field values are not validated by default (bsc#1282378).\n\nChanges for netty:\n\n- Upgrade to upstream version 4.1.138\n\nChanges for netty-tcnative:\n\n- Upgrade to version 2.0.84 Final\n","status":"published","published":"2026-09-29T11:47:41Z","modified":"2026-09-30T12:00:04.604890726Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}