https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T08:14:07.968468+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-08648 bdu:2023-08648 2026-10-03T08:14:08.587885+00:00 bdu:2023-08648 https://cve.radiocsirt.org/vuln/certfr-2022-avi-366 certfr-2022-avi-366 — De multiples vulnérabilités ont été découvertes dans Oracle PeopleSoft. Certaines d'entre elles permettent à un attaqua… 2026-10-03T08:14:08.587956+00:00 certfr-2022-avi-366 https://cve.radiocsirt.org/vuln/euvd-2026-32665 EUVD-2026-32665 2026-10-03T08:14:08.587977+00:00 EUVD-2026-32665 https://cve.radiocsirt.org/vuln/fkie_cve-2021-43797 fkie_cve-2021-43797 2026-10-03T08:14:08.587990+00:00

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

 https://cve.radiocsirt.org/vuln/ghsa-wx5j-54mm-rqqq GHSA-wx5j-54mm-rqqq — HTTP request smuggling in netty 2026-10-03T08:14:08.588023+00:00

Affected: Maven: io.netty:netty-codec-http, Maven: org.jboss.netty:netty, Maven: io.netty:netty

### Impact

Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling.

Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore and so not do the validation itself.

 https://cve.radiocsirt.org/vuln/gsd-2021-43797 gsd-2021-43797 2026-10-03T08:14:08.588056+00:00 gsd-2021-43797 https://cve.radiocsirt.org/vuln/oesa-2021-1472 OESA-2021-1472 — netty security update 2026-10-03T08:14:08.588068+00:00

Affected: openEuler:20.03-LTS-SP1: netty, openEuler:20.03-LTS-SP2: netty

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. %package help Summary: Documents for Buildarch: noarch Requires: man info Provides: -javadoc = - Obsoletes: -javadoc < - %description help Man pages and other related documents for . Security Fix(es): Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.7.1.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.7.1.Final to receive a patch.(CVE-2021-43797)

 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11743-1 openSUSE-SU-2024:11743-1 — netty-4.1.72-1.1 on GA media 2026-10-03T08:14:08.588098+00:00

netty-4.1.72-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2022:0520 RHSA-2022:0520 — Red Hat Security Advisory: Red Hat Data Grid 8.3.0 security update 2026-10-03T08:14:08.588116+00:00

wildfly-elytron: possible timing attack in ScramServer XStream: remote command execution attack by manipulating the processed input stream netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way xstream: Arbitrary code execution via unsafe deserialization of Xalan xsltc.trax.TemplatesImpl xstream: Infinite loop DoS via unsafe deserialization of sun.reflect.annotation.AnnotationInvocationHandler xstream: Arbitrary code execution via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* xstream: Arbitrary code execution via unsafe deserialization of sun.tracing.* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration xstream: Arbitrary code execution via unsafe deserialization of javax.swing.UIDefaults$ProxyLazyValue xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapSearchEnumeration xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.toolkit.dir.ContextEnumerator xstream: Arbitrary code execution via unsafe deserialization of com.sun.corba.* xstream: Server-side request forgery (SSRF) via unsafe deserialization of com.sun.xml.internal.ws.client.sei.* xstream: Arbitrary code execution via unsafe deserialization of com.sun.jndi.ldap.LdapBindingEnumeration xstream: Server-side request forgery (SSRF) via unsafe deser…

 https://cve.radiocsirt.org/vuln/suse-su-2022:1271-1 SUSE-SU-2022:1271-1 — Security update for netty 2026-10-03T08:14:08.588168+00:00

Security update for netty

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-43797 UBUNTU-CVE-2021-43797 2026-10-03T08:14:08.588186+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:22.04:LTS: netty

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0607 WID-SEC-W-2022-0607 — Red Hat FUSE: Mehrere Schwachstellen 2026-10-03T08:14:08.588215+00:00

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.