https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T13:39:18.084484+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-di52331 CLEANSTART-2026-DI52331 — Security fix for CVE-2026-73508 applied in: keycloak 26.5.7-r7 2026-10-02T13:39:18.119997+00:00

Affected: CleanStart: keycloak

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-352262 EUVD-2026-352262 2026-10-02T13:39:18.120068+00:00 EUVD-2026-352262 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73508 fkie_cve-2026-73508 2026-10-02T13:39:18.120084+00:00

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

 https://cve.radiocsirt.org/vuln/ghsa-mfg7-5gfp-c4w3 GHSA-mfg7-5gfp-c4w3 — Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names 2026-10-02T13:39:18.120111+00:00

Affected: Maven: io.netty:netty-codec-dns

### Summary A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service.

### Details Inside `io.netty.handler.codec.dns.AbstractDnsRecord`, the parsed domain name string is passed to `IDN.toASCII(name)`. If the domain name contains characters that violate IDNA rules, `IDN.toASCII` throws an `IllegalArgumentException`.

Because this exception occurs inside the constructor before the `DnsRecord` instance can assign the buffer to its content field for later release, the ByteBuf whose reference count was incremented (or newly allocated) is never released, resulting in a direct memory leak.

There are several places where variants of this leak happen: - `io.netty.handler.codec.dns.DefaultDnsRecordDecoder#decodeRecord(java.lang.String, io.netty.handler.codec.dns.DnsRecordType, int, long, io.netty.buffer.ByteBuf, int, int)` invokes `in.retainedDuplicate()` or creates a new buffer `out` when constructing `DefaultDnsRawRecord` - `io.netty.handler.codec.dns.DnsCodecUtil#decompressDomainName` allocates a new `ByteBuf` and passes it to `encodeDomainName()`. If the decompressed domain name contains a null byte (`\0`), `encodeDomainName()` throws an `IllegalArgumentException`, leaking the newly allocated buffer.

### Impact Resource Exhaustion. Any application utilizing Netty's DnsRecordDecoder (such as DnsNameResolve…

 https://cve.radiocsirt.org/vuln/ncsc-2026-0375 NCSC-2026-0375 — Kwetsbaarheden verholpen in Oracle Communications 2026-10-02T13:39:18.120150+00:00 NCSC-2026-0375 https://cve.radiocsirt.org/vuln/rhsa-2026:68754 RHSA-2026:68754 — Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.1 Release. 2026-10-02T13:39:18.120203+00:00

lodash: lodash: Arbitrary code execution via untrusted input in template imports postcss: PostCSS: Information disclosure and denial of service via crafted CSS input baseline-browser-mapping: baseline-browser-mapping: Denial of Service via improper input handling find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak linkify-it: linkify-it: Denial of Service via crafted mailto: links io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) nanoid: nanoid: Denial of Service via infinite loop in random ID generation axios: axios: Denial of Service via uncontrolled recursion in form data processing axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth axios: axios: Information disclosure via Prototype Pollution in Node HTTP adapter a…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-73508 UBUNTU-CVE-2026-73508 2026-10-02T13:39:18.120285+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:Pro:26.04:LTS: netty

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() rejected a malformed domain name, allowing unauthenticated remote DNS packets to leak direct memory incrementally until denial of service. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2511 WID-SEC-W-2026-2511 — Netty: Mehrere Schwachstellen ermöglichen Denial of Service 2026-10-02T13:39:18.120323+00:00

Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um einen Denial of Service Angriff durchzuführen.