https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T09:55:30.083479+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-08933 bdu:2026-08933 2026-10-03T09:55:30.581869+00:00 bdu:2026-08933 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0773 certfr-2026-avi-0773 — De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un at… 2026-10-03T09:55:30.581942+00:00 certfr-2026-avi-0773 https://cve.radiocsirt.org/vuln/cleanstart-2026-bk55944 Withdrawn: CLEANSTART-2026-BK55944 — Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2… 2026-10-03T09:55:30.581963+00:00

Withdrawn by the publisher.

Affected: CleanStart: keycloak

Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-371762 EUVD-2026-371762 2026-10-03T09:55:30.582002+00:00 EUVD-2026-371762 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42579 fkie_cve-2026-42579 2026-10-03T09:55:30.582015+00:00

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

 https://cve.radiocsirt.org/vuln/ghsa-cm33-6792-r9fm GHSA-cm33-6792-r9fm — Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder) 2026-10-03T09:55:30.582040+00:00

Affected: Maven: io.netty:netty-codec-dns

# Security Vulnerability Report: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

## 1. Vulnerability Summary

| Field | Value | |-------|-------| | **Product** | Netty | | **Version** | 4.2.12.Final (and all prior versions with codec-dns) | | **Component** | `io.netty.handler.codec.dns.DnsCodecUtil` | | **Vulnerability Type** | CWE-20: Improper Input Validation / CWE-626: Null Byte Interaction Error / CWE-400: Uncontrolled Resource Consumption | | **Impact** | DNS Cache Poisoning / Domain Validation Bypass / Denial of Service / Malformed DNS Packets |

## 2. Affected Components

Both the encoder and decoder in the same file are affected:

- `io.netty.handler.codec.dns.DnsCodecUtil` — `encodeDomainName()` method (lines 31-51): - No null byte validation in domain name labels - No per-label length validation (RFC 1035 max: 63 bytes) - No total domain name length validation (RFC 1035 max: 255 bytes) - Empty labels silently truncate the domain name

- `io.netty.handler.codec.dns.DnsCodecUtil` — `decodeDomainName()` method (lines 53-118): - No per-label length validation (max 63) - No total domain name length validation (max 255) - Unbounded StringBuilder growth from attacker-controlled DNS responses

## 3. Vulnerability Description

Netty's DNS codec does **not enforce RFC 1035 domain name constraints** during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10795-1 openSUSE-SU-2026:10795-1 — netty-4.1.133-1.1 on GA media 2026-10-03T09:55:30.582143+00:00

netty-4.1.133-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:23808 RHSA-2026:23808 — Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4 release and security update 2026-10-03T09:55:30.582168+00:00

netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42579 UBUNTU-CVE-2026-42579 2026-10-03T09:55:30.582192+00:00

Affected: Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:25.10: netty, Ubuntu:Pro:26.04:LTS: netty

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1372 WID-SEC-W-2026-1372 — Netty: Mehrere Schwachstellen 2026-10-03T09:55:30.582221+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.