https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:41:31.241875+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-15316 bdu:2026-15316 2026-10-02T18:41:31.979825+00:00 bdu:2026-15316 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0933 certfr-2026-avi-0933 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T18:41:31.979886+00:00 certfr-2026-avi-0933 https://cve.radiocsirt.org/vuln/cleanstart-2026-bk55944 Withdrawn: CLEANSTART-2026-BK55944 — Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2… 2026-10-02T18:41:31.979908+00:00

Withdrawn by the publisher.

Affected: CleanStart: keycloak

Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-371766 EUVD-2026-371766 2026-10-02T18:41:31.979944+00:00 EUVD-2026-371766 https://cve.radiocsirt.org/vuln/fkie_cve-2026-45674 fkie_cve-2026-45674 2026-10-02T18:41:31.979956+00:00

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

 https://cve.radiocsirt.org/vuln/ghsa-676x-f7gg-47vc GHSA-676x-f7gg-47vc — Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records 2026-10-02T18:41:31.979980+00:00

Affected: Maven: io.netty:netty-resolver-dns

### Summary Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses.

### Details In `io.netty.resolver.dns.DnsResolveContext#buildAliasMap`, the resolver processes the ANSWER section of a DNS response and blindly caches all CNAME records it finds.

According to https://datatracker.ietf.org/doc/html/rfc5452#section-6

``` Care must be taken to only accept data if it is known that the originator is authoritative for the QNAME or a parent of the QNAME. One very simple way to achieve this is to only accept data if it is part of the domain for which the query was intended. ```

### Impact DNS Cache Poisoning (Bailiwick Bypass). Any application using Netty's DNS resolver is impacted.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11033-1 openSUSE-SU-2026:11033-1 — netty-4.1.135-1.1 on GA media 2026-10-02T18:41:31.980010+00:00

netty-4.1.135-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:26017 RHSA-2026:26017 — Red Hat Security Advisory: Red Hat build of Quarkus 3.33.2.SP1 security update 2026-10-02T18:41:31.980037+00:00

eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-45674 UBUNTU-CVE-2026-45674 2026-10-02T18:41:31.980074+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:25.10: netty, Ubuntu:Pro:26.04:LTS: netty

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1814 WID-SEC-W-2026-1814 — Netty: Mehrere Schwachstellen 2026-10-02T18:41:31.980105+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.