https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:46:51.330270+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-fr63847 Withdrawn: CLEANSTART-2026-FR63847 — yawkat LZ4 Java provides LZ4 compression for Java 2026-10-02T17:46:51.339515+00:00

Withdrawn by the publisher.

Affected: CleanStart: elasticsearch

Multiple security vulnerabilities affect the elasticsearch package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-359361 EUVD-2026-359361 2026-10-02T17:46:51.339579+00:00 EUVD-2026-359361 https://cve.radiocsirt.org/vuln/fkie_cve-2026-62380 fkie_cve-2026-62380 2026-10-02T17:46:51.339604+00:00

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.

 https://cve.radiocsirt.org/vuln/ghsa-jmpc-xv4r-m7fw GHSA-jmpc-xv4r-m7fw 2026-10-02T17:46:51.339647+00:00

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11882-1 openSUSE-SU-2026:11882-1 — netty-4.1.138-1.1 on GA media 2026-10-02T17:46:51.339681+00:00

netty-4.1.138-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-62380 UBUNTU-CVE-2026-62380 2026-10-02T17:46:51.339734+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:Pro:26.04:LTS: netty

Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2712 WID-SEC-W-2026-2712 — Netty: Mehrere Schwachstellen 2026-10-02T17:46:51.339767+00:00

Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.