https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T09:21:58.100191+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-00315 bdu:2022-00315 2026-10-04T09:21:58.696080+00:00 bdu:2022-00315 https://cve.radiocsirt.org/vuln/certfr-2021-avi-407 certfr-2021-avi-407 — De multiples vulnérabilités ont été découvertes dans le noyau Linux de Red Hat. Certaines d'entre elles permettent à un… 2026-10-04T09:21:58.696158+00:00 certfr-2021-avi-407 https://cve.radiocsirt.org/vuln/cleanstart-2026-ci66802 Withdrawn: CLEANSTART-2026-CI66802 — Security fixes for CVE-2015-2104, CVE-2020-8908, CVE-2021-21295, CVE-2021-21409, CVE-2021-37136, CVE-2022-1471, CVE-202… 2026-10-04T09:21:58.696182+00:00

Withdrawn by the publisher.

Affected: CleanStart: cassandra-fips

Multiple security vulnerabilities affect the cassandra-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-22229 EUVD-2026-22229 2026-10-04T09:21:58.696225+00:00 EUVD-2026-22229 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21409 fkie_cve-2021-21409 2026-10-04T09:21:58.696238+00:00

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

 https://cve.radiocsirt.org/vuln/ghsa-f256-j965-7f32 GHSA-f256-j965-7f32 — Possible request smuggling in HTTP/2 due missing validation of content-length 2026-10-04T09:21:58.696266+00:00

Affected: Maven: io.netty:netty-codec-http2, Maven: org.jboss.netty:netty, Maven: io.netty:netty

### Impact The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1

This is a followup of https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj which did miss to fix this one case.

### Patches This was fixed as part of 4.1.61.Final

### Workarounds Validation can be done by the user before proxy the request by validating the header.

 https://cve.radiocsirt.org/vuln/gsd-2021-21409 gsd-2021-21409 2026-10-04T09:21:58.696298+00:00 gsd-2021-21409 https://cve.radiocsirt.org/vuln/oesa-2021-1161 OESA-2021-1161 — netty security update 2026-10-04T09:21:58.696310+00:00

Affected: openEuler:20.03-LTS-SP1: netty

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. %package help Summary: Documents for %{name} Buildarch: noarch Requires: man info Provides: %{name}-javadoc = %{version}-%{release} Obsoletes: %{name}-javadoc < %{version}-%{release} %description help Man pages and other related documents for %{name}. Security Fix(es): Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has…

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:14442-1 openSUSE-SU-2024:14442-1 — netty-4.1.114-1.1 on GA media 2026-10-04T09:21:58.696348+00:00

netty-4.1.114-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2021:1511 RHSA-2021:1511 — Red Hat Security Advisory: AMQ Clients 2.9.1 release and security update 2026-10-04T09:21:58.696372+00:00

netty: Information disclosure via the local system temporary directory netty: possible request smuggling in HTTP/2 due missing validation netty: Request smuggling via content-length header

 https://cve.radiocsirt.org/vuln/suse-su-2022:1315-1 SUSE-SU-2022:1315-1 — Security update for netty 2026-10-04T09:21:58.696392+00:00

Security update for netty

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-21409 UBUNTU-CVE-2021-21409 2026-10-04T09:21:58.696408+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:22.04:LTS: netty

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-0809 WID-SEC-W-2023-0809 — IBM QRadar SIEM: Mehrere Schwachstellen 2026-10-04T09:21:58.696439+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Informationen falsch darzustellen, einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Scripting-Angriff durchzuführen oder unbekannte Auswirkungen zu verursachen.