CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- nettyNetty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks7.4 High
- nettyNetty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)7.5 High
- nettyNetty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state6.5 Medium
- nettyNetty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled8.3 High
- nettyNetty has a Security Control Bypass via CORS Short-Circuit Failure6.5 Medium
- nettyNetty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion8.7 High
- nettyNetty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion8.7 High
- nettyNetty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation7.5 High
- nettyNetty SPDY SETTINGS frame count materializes unbounded settings map7.5 High
- nettyNetty susceptible to HTTP/2 Reset Attack with different on-the-wire signature6.9 Medium
- nettyNetty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted5.3 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty has unbounded pre-allocation in RedisArrayAggregator from RESP array length7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty's wrapping plain trust manager silently disables hostname verification7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 moreNetty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 morenetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion5.3 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty has Insufficient Bailiwick Validation for NS Records8.7 High
- nettyNetty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced5.3 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +8 more +10 moreNetty: SCTP reassembly nests buffers without bound7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records8.7 High
- nettyNetty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port6.8 Medium
- nettyNetty: Unix-socket fd receive leaks descriptors when peer sends two at once4.0 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +23 more +25 moreNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length7.5 High
- nettyNetty: Denial of Service via Unbounded Headers in StompSubframeDecoder7.5 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty has Unbounded Direct Memory Consumption in its RedisDecoder7.5 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking8.1 High
- netty, io.netty netty-codec-mqtt, red hat amq broker 7.13.6 +8 more +10 moreNetty: Resource exhaustion in MqttDecoder5.3 Medium
- netty, io.netty netty-codec-http, netty-codec-http2 +37 more +39 moreNetty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS7.5 High
- netty, io.netty netty-codec-redis +1 moreNetty: CRLF Injection in Netty Redis Codec Encoder6.8 Medium
- netty, io.netty netty-codec-http +1 moreNetty: HTTP Request Smuggling due to malformed Transfer-Encoding6.5 Medium
- netty, io.netty netty-codec-http, red hat cryostat 4 on rhel 9 +33 more +35 moreNetty: HttpClientCodec response desynchronization7.3 High
- netty, io.netty netty-codec, netty-codec-compression +2 moreNetty: Lz4FrameDecoder resource exhaustion7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization5.8 Medium
- netty, io.netty netty-codec-http +1 moreNetty: HTTP Request Smuggling due to incorrect chunk size parsing6.5 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP Header Injection via HttpProxyHandler Disabled Validation2.9 Low
- nettyNetty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()5.3 Medium
- netty, red hat cryostat 4, cryostat 4 on rhel 9 +37 more +39 moreNetty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass8.7 High
- netty, red hat cryostat 4 on rhel 9, logging subsystem for red hat openshift +33 more +35 moreNetty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing7.5 High
- nettyNetty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder6.5 Medium
- nettyNetty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery5.5 Medium
- nettyNetty's BrotliDecoder is vulnerable to DoS via zip bomb style attack6.9 Medium
- nettyNetty is vulnerable to request smuggling due to incorrect parsing of chunk extensions2.9 Low
- nettyNetty MadeYouReset HTTP/2 DDoS Vulnerability8.2 High
- nettyDenial of Service attack on windows app using Netty5.5 Medium
- netty, netapp active iq unified manager, oncommand insight +2 moreSslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine7.5 High
- nettyDenial of Service attack on windows app using Netty5.5 Medium
- netty, debian linux +1 moreNetty HttpPostRequestDecoder can OOM5.3 Medium
- Show moreLoading…