Skip to contentRed Hat Cryostat 4 vulnerabilities
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesCVE-2026-45416Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +23 more +25 moreNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthCVE-2026-44893Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingCVE-2026-44249Fix available8.1 High
- netty, io.netty netty-codec-http, netty-codec-http2 +37 more +39 moreNetty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSCVE-2026-42587Fix available7.5 High
- netty, io.netty netty-codec-http, red hat cryostat 4 on rhel 9 +33 more +35 moreNetty: HttpClientCodec response desynchronizationCVE-2026-42584Fix available7.3 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationCVE-2026-42581Fix available5.8 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)CVE-2026-42579Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP Header Injection via HttpProxyHandler Disabled ValidationCVE-2026-42578Fix available2.9 Low
- netty, red hat cryostat 4, cryostat 4 on rhel 9 +37 more +39 moreNetty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassCVE-2026-33871Public exploitFix available8.7 High
- netty, red hat cryostat 4 on rhel 9, logging subsystem for red hat openshift +33 more +35 moreNetty: HTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-33870Fix available7.5 High
- isaacs node-tar, tar, red hat confidential compute attestation +40 more +42 morenode-tar Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path SanitizationCVE-2026-23745Public exploitFix available8.2 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +53 more +55 morefast-uri vulnerable to host confusion via percent-encoded authority delimitersCVE-2026-6322Fix available7.5 High
- fast-uri, red hat cluster observability operator 1.5.0, confidential compute attestation +32 more +34 morefast-uri vulnerable to path traversal via percent-encoded dot segmentsCVE-2026-6321Fix available7.5 High
- golang net, golang.org/x/net golang.org/x/net/idna, go standard library net/http +147 more +149 moreInvoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idnaCVE-2026-39821Fix available9.6 Critical