https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:43:50.119154+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-02T10:43:50.167068+00:00 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/cleanstart-2026-ex11941 CLEANSTART-2026-EX11941 — Security fix for CVE-2026-62243 applied in: apache-zookeeper 3.8.6-r6, apache-zookeeper 3.9.5-r6, elasticsearch 9.5.2-r… 2026-10-02T10:43:50.167123+00:00

Affected: CleanStart: apache-zookeeper, CleanStart: elasticsearch, CleanStart: keycloak, CleanStart: solr, CleanStart: trino

CVE-2026-62243 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-358320 EUVD-2026-358320 2026-10-02T10:43:50.167165+00:00 EUVD-2026-358320 https://cve.radiocsirt.org/vuln/fkie_cve-2026-62243 fkie_cve-2026-62243 2026-10-02T10:43:50.167178+00:00

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.

 https://cve.radiocsirt.org/vuln/ghsa-c3j3-64rf-grvf GHSA-c3j3-64rf-grvf 2026-10-02T10:43:50.167201+00:00

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11882-1 openSUSE-SU-2026:11882-1 — netty-4.1.138-1.1 on GA media 2026-10-02T10:43:50.167218+00:00

netty-4.1.138-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:66488 RHSA-2026:66488 — Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update 2026-10-02T10:43:50.167295+00:00

bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid webpack-dev-server: webpack-dev-server: Information disclosure and denial of service via improper proxy configuration jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections form-data: form-data: Form field override via CRLF injection undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests jdbc.postgresql.org: pgjdbc: Client…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-62243 UBUNTU-CVE-2026-62243 2026-10-02T10:43:50.167423+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:Pro:26.04:LTS: netty

Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2712 WID-SEC-W-2026-2712 — Netty: Mehrere Schwachstellen 2026-10-02T10:43:50.167452+00:00

Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um Informationen offenzulegen.