io.netty:netty-codec-xml vulnerabilities (TuxCare)
77 vulnerabilities.
-
io.netty:netty-codec-xmlTuxCare Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext 9.1 Critical -
io.netty:netty-codec-xmlTuxCare Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing 8.7 High -
io.netty:netty-codec-xmlTuxCare Netty: Memory Exhaustion in SctpMessageCompletionHandler 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty: epoll transport denial of service via RST on half-closed TCP connection 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names 5.3 Medium -
io.netty:netty-codec-xmlTuxCare Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder 5.7 Medium -
io.netty:netty-codec-xmlTuxCare Netty: STOMP CONNECT Frame Header Injection 6.5 Medium -
io.netty:netty-codec-xmlTuxCare Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address 5.5 Medium -
io.netty:netty-codec-xmlTuxCare Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang 8.7 High -
io.netty:netty-codec-xmlTuxCare Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass 6.9 Medium -
io.netty:netty-codec-xmlTuxCare Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service 6.9 Medium -
io.netty:netty-codec-xmlTuxCare Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation 6.3 Medium -
io.netty:netty-codec-xmlTuxCare Netty: TOCTOU in OcspServerCertificateValidator 7.4 High -
io.netty:netty-codec-xmlTuxCare Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator 7.4 High -
io.netty:netty-codec-xmlTuxCare Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks 7.4 High -
io.netty:netty-codec-xmlTuxCare Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state 6.5 Medium -
io.netty:netty-codec-xmlTuxCare Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled 8.3 High -
io.netty:netty-codec-xmlTuxCare Netty has a Security Control Bypass via CORS Short-Circuit Failure 6.5 Medium -
io.netty:netty-codec-xmlTuxCare Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion 8.7 High -
io.netty:netty-codec-xmlTuxCare Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion 8.7 High -
io.netty:netty-codec-xmlTuxCare Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty SPDY SETTINGS frame count materializes unbounded settings map 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature 6.9 Medium -
io.netty:netty-codec-xmlTuxCare Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted 5.3 Medium -
io.netty:netty-codec-xmlTuxCare Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty's wrapping plain trust manager silently disables hostname verification 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion 8.7 High -
io.netty:netty-codec-xmlTuxCare netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion 5.3 Medium -
io.netty:netty-codec-xmlTuxCare Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator 8.7 High -
io.netty:netty-codec-xmlTuxCare Netty has Insufficient Bailiwick Validation for NS Records 8.7 High -
io.netty:netty-codec-xmlTuxCare Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced 5.3 Medium -
io.netty:netty-codec-xmlTuxCare Netty: SCTP reassembly nests buffers without bound 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records 8.7 High -
io.netty:netty-codec-xmlTuxCare Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port 6.8 Medium -
io.netty:netty-codec-xmlTuxCare Netty: Unix-socket fd receive leaks descriptors when peer sends two at once 4.0 Medium -
io.netty:netty-codec-xmlTuxCare Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty has Unbounded Direct Memory Consumption in its RedisDecoder 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking 8.1 High -
io.netty:netty-codec-xmlTuxCare Netty: Resource exhaustion in MqttDecoder 5.3 Medium -
io.netty:netty-codec-xmlTuxCare Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty: CRLF Injection in Netty Redis Codec Encoder 6.8 Medium -
io.netty:netty-codec-xmlTuxCare Netty: HTTP Request Smuggling due to malformed Transfer-Encoding 6.5 Medium -
io.netty:netty-codec-xmlTuxCare Netty: HttpClientCodec response desynchronization 7.3 High -
io.netty:netty-codec-xmlTuxCare Netty: Lz4FrameDecoder resource exhaustion 7.5 High -
io.netty:netty-codec-xmlTuxCare Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization 5.8 Medium - Show olderLoading…