https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T07:05:02.077510+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-10993 bdu:2025-10993 2026-10-04T07:05:02.285493+00:00 bdu:2025-10993 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0754 certfr-2025-avi-0754 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-04T07:05:02.285556+00:00 certfr-2025-avi-0754 https://cve.radiocsirt.org/vuln/cleanstart-2026-cl03013 Withdrawn: CLEANSTART-2026-CL03013 — Netty is an asynchronous, event-driven network application framework 2026-10-04T07:05:02.285577+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-hive

Multiple security vulnerabilities affect the apache-hive package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-260033 EUVD-2026-260033 2026-10-04T07:05:02.285608+00:00 EUVD-2026-260033 https://cve.radiocsirt.org/vuln/fkie_cve-2025-55163 fkie_cve-2025-55163 2026-10-04T07:05:02.285622+00:00

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

 https://cve.radiocsirt.org/vuln/ghsa-prj3-ccx8-p6x4 GHSA-prj3-ccx8-p6x4 — Netty affected by MadeYouReset HTTP/2 DDoS vulnerability 2026-10-04T07:05:02.285645+00:00

Affected: Maven: io.netty:netty-codec-http2, Maven: io.grpc:grpc-netty-shaded

Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.”

### MadeYouReset Vulnerability Summary The MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service.

### Mechanism The vulnerability uses malformed HTTP/2 control frames, or malformed flow, in order to make the server reset streams created by the client (using the RST_STREAM frame). The vulnerability could be triggered by several primitives, defined by the RFC of HTTP/2 (RFC 9113). The Primitives are: 1. WINDOW_UPDATE frame with an increment of 0 or an increment that makes the window exceed 2^31 - 1. (section 6.9 + 6.9.1) 2. HEADERS or DATA frames sent on a half-closed (remote) stream (which was closed using the END_STREAM flag). (note that for some implementations it's possible a CONTINUATION frame to trigger that as well - but it's very rare). (Section 5.1) 3. PRIORITY frame with a length other than 5. (section 6.3) From our experience, the primitives are likely to exist in the decreasing order listed above. Note that based on the implementation of the library, other primitives (which are not defined by the RFC) might exist - meaning scenarios in which RST_STREAM is not supposed to be sent, but in the implementation it does. On the other hand - some RFC-defined primi…

 https://cve.radiocsirt.org/vuln/jvndb-2026-020740 jvndb-2026-020740 2026-10-04T07:05:02.285702+00:00

Hitachi Infrastructure Analytics Advisor contains the following vulnerability: CVE-2025-48924 Hitachi Ops Center Analyzer contains the following vulnerabilities: CVE-2025-48924 Hitachi Ops Center Analyzer viewpoint contains the following vulnerability: CVE-2025-48924 Hitachi Ops Center Viewpoint contains the following vulnerabilities: CVE-2023-35116, CVE-2025-24970, CVE-2025-25193, CVE-2025-48924, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057

 https://cve.radiocsirt.org/vuln/ncsc-2026-0022 NCSC-2026-0022 — Kwetsbaarheden verholpen in Oracle Communications producten 2026-10-04T07:05:02.285722+00:00 NCSC-2026-0022 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15483-1 openSUSE-SU-2025:15483-1 — netty-4.1.124-1.1 on GA media 2026-10-04T07:05:02.285782+00:00

netty-4.1.124-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:14004 RHSA-2025:14004 — Red Hat Security Advisory: Red Hat build of Quarkus 3.15.6.SP1 security update 2026-10-04T07:05:02.285799+00:00

netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability

 https://cve.radiocsirt.org/vuln/suse-su-2025:03021-1 SUSE-SU-2025:03021-1 — Security update for netty 2026-10-04T07:05:02.285815+00:00

Security update for netty

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-55163 UBUNTU-CVE-2025-55163 2026-10-04T07:05:02.285829+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:22.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:24.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:25.10: netty

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1830 WID-SEC-W-2025-1830 — http/2 Implementierungen: Schwachstelle ermöglicht Denial of Service 2026-10-04T07:05:02.285861+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiednen http/2 Implementierungen ausnutzen, um einen Denial of Service Angriff durchzuführen.