https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:24:46.745240+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0991 certfr-2026-avi-0991 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu Greenplum. Elles permettent à un attaquant de provoqu… 2026-10-02T14:24:46.841275+00:00 certfr-2026-avi-0991 https://cve.radiocsirt.org/vuln/cleanstart-2026-am39668 Withdrawn: CLEANSTART-2026-AM39668 — yawkat LZ4 Java provides LZ4 compression for Java 2026-10-02T14:24:46.841325+00:00

Withdrawn by the publisher.

Affected: CleanStart: apache-nifi

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-342456 EUVD-2026-342456 2026-10-02T14:24:46.841360+00:00 EUVD-2026-342456 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59900 fkie_cve-2026-59900 2026-10-02T14:24:46.841400+00:00

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

 https://cve.radiocsirt.org/vuln/ghsa-c69g-56f8-xwqj GHSA-c69g-56f8-xwqj — Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass 2026-10-02T14:24:46.841442+00:00

Affected: Maven: io.netty:netty-codec-http2

Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11394-1 openSUSE-SU-2026:11394-1 — netty-4.1.136-1.1 on GA media 2026-10-02T14:24:46.841470+00:00

netty-4.1.136-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:47172 RHSA-2026:47172 — Red Hat Security Advisory: Red Hat build of Quarkus 3.33.2.SP3 security update 2026-10-02T14:24:46.841498+00:00

vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket) io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) io.netty/netty-codec-http2: Netty: Improper header neutrali…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59900 UBUNTU-CVE-2026-59900 2026-10-02T14:24:46.841546+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:Pro:26.04:LTS: netty

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2356 WID-SEC-W-2026-2356 — Netty: Mehrere Schwachstellen 2026-10-02T14:24:46.841578+00:00

Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsprüfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen.