https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T15:23:43.244174+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-cl03013 Withdrawn: CLEANSTART-2026-CL03013 — Netty is an asynchronous, event-driven network application framework 2026-10-04T15:23:43.325161+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-hive

Multiple security vulnerabilities affect the apache-hive package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-339462 EUVD-2026-339462 2026-10-04T15:23:43.325216+00:00 EUVD-2026-339462 https://cve.radiocsirt.org/vuln/fkie_cve-2026-56817 fkie_cve-2026-56817 2026-10-04T15:23:43.325232+00:00

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

 https://cve.radiocsirt.org/vuln/ghsa-4qhr-g3c6-fcfx GHSA-4qhr-g3c6-fcfx — Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling 2026-10-04T15:23:43.325257+00:00

Affected: Maven: io.netty:netty-codec-xml

Any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a DOCTYPE declaration to a parser instantiated with no security configuration — but whether external entities are actually resolved depends on Aalto XML's async parser behavior, making this a confirmed misconfiguration with conditional exploitability.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11394-1 openSUSE-SU-2026:11394-1 — netty-4.1.136-1.1 on GA media 2026-10-04T15:23:43.325284+00:00

netty-4.1.136-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:54622 RHSA-2026:54622 — Red Hat Security Advisory: Red Hat Build of Apache Camel 4.18.3 for Spring Boot release. 2026-10-04T15:23:43.325311+00:00

eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data camel-jms: Apache Camel JMS components: Arbitrary Exchange state injection io.netty/netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder commons-configuration: Apache Commons Configuration: Denial of Service via uncontrolled recursion with crafted YAML input org.apache.camel/camel-mail: Apache Camel Mail Component: Credential exposure and information disclosure via improper input validation of mail headers org.apache.camel/camel-cxf: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass jackson-databind: Jackson-databind: Security bypass allow…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-56817 UBUNTU-CVE-2026-56817 2026-10-04T15:23:43.325373+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:Pro:26.04:LTS: netty

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2356 WID-SEC-W-2026-2356 — Netty: Mehrere Schwachstellen 2026-10-04T15:23:43.325404+00:00

Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsprüfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen.