Most recent entries from all

bdu:2023-05619

certfr-2023-avi-0325 — De multiples vulnérabilités ont été découvertes dans les produits Oracle. Certaines d'entre elles permettent à un attaq…

certfr-2023-avi-0325

Withdrawn: CLEANSTART-2026-CI66802 — Security fixes for CVE-2015-2104, CVE-2020-8908, CVE-2021-21295, CVE-2021-21409, CVE-2021-37136, CVE-2022-1471, CVE-202…

Withdrawn by the publisher.

Affected: CleanStart: cassandra-fips

Multiple security vulnerabilities affect the cassandra-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-232489

fkie_cve-2022-41881

Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.

GHSA-fx2c-96vj-985v — HAProxyMessageDecoder Stack Exhaustion DoS

Affected: Maven: io.netty:netty-codec-haproxy

### Impact A StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion.

### Patches Users should upgrade to 4.1.86.Final.

### Workarounds There is no workaround, except using a custom HaProxyMessageDecoder.

### References When parsing a TLV with type = PP2_TYPE_SSL, the value can be again a TLV with type = PP2_TYPE_SSL and so on. The only limitation of the recursion is that the TLV length cannot be bigger than 0xffff because it is encoded in an unsigned short type. Providing a TLV with a nesting level that is large enough will lead to raising of a StackOverflowError. The StackOverflowError will be caught if HAProxyMessageDecoder is used as part of Netty’s ChannelPipeline, but using it directly without the ChannelPipeline will lead to a thrown exception / crash.

### For more information If you have any questions or comments about this advisory: * Open an issue in [netty](https://github.com/netty/netty)

gsd-2022-41881

OESA-2023-1905 — netty security update

Affected: openEuler:20.03-LTS-SP3: netty

Asynchronous event-driven network application Java framework. Security Fix(es): Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing a malformed crafted message due to an infinite recursion. This issue is patched in version 4.1.86.Final. There is no workaround, except using a custom HaProxyMessageDecoder.(CVE-2022-41881)

openSUSE-SU-2024:14442-1 — netty-4.1.114-1.1 on GA media

netty-4.1.114-1.1 on GA media

RHSA-2023:0577 — Red Hat Security Advisory: Red Hat build of Eclipse Vert.x 4.3.7 security update

dev-java/snakeyaml: DoS via stack overflow codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS

SUSE-SU-2023:2096-2 — Security update for netty, netty-tcnative

Security update for netty, netty-tcnative

UBUNTU-CVE-2022-41881

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:16.04:LTS: netty-3.9, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:18.04:LTS: netty-3.9, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:22.04:LTS: netty

WID-SEC-W-2023-0091 — NetApp ActiveIQ Unified Manager: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in NetApp ActiveIQ Unified Manager ausnutzen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipulieren.