Most recent entries from all

certfr-2025-avi-0106 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0106

Withdrawn: CLEANSTART-2026-CU18187 — Security fixes in stargate 1.0.90-r4

Withdrawn by the publisher.

Affected: CleanStart: stargate

Package stargate version 1.0.90-r4 fixes 87 vulnerabilities: ghsa-76h9-2vwh-w278, ghsa-pqr6-cmr2-h8hf, ghsa-fjpj-2g6w-x25r, ghsa-qcwq-55hx-v3vh, ghsa-55g7-9cwv-5qfv...

EUVD-2026-201469

fkie_cve-2024-47535

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.

GHSA-xq3w-v528-46rv — Denial of Service attack on windows app using netty

Affected: Maven: io.netty:netty-common

### Summary

An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attemps to load a file that does not exist. If an attacker creates such a large file, the Netty application crash.

### Details

When the library netty is loaded in a java windows application, the library tries to identify the system environnement in which it is executed.

At this stage, Netty tries to load both `/etc/os-release` and `/usr/lib/os-release` even though it is in a Windows environment.

If netty finds this files, it reads them and loads them into memory.

By default :

- The JVM maximum memory size is set to 1 GB, - A non-privileged user can create a directory at `C:\` and create files within it.

the source code identified : https://github.com/netty/netty/blob/4.1/common/src/main/java/io/netty/util/internal/PlatformDependent.java

Despite the implementation of the function `normalizeOs()` the source code not verify the OS before reading `C:\etc\os-release` and `C:\usr\lib\os-release`.

### PoC

Create a file larger than 1 GB of data in `C:\etc\os-release` or `C:\usr\lib\os-releas…

openSUSE-SU-2024:14549-1 — netty-4.1.115-1.1 on GA media

netty-4.1.115-1.1 on GA media

RHSA-2025:0900 — Red Hat Security Advisory: Red Hat build of Quarkus 3.15.3 release and security update

io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling netty: Denial of Service attack on windows app using Netty

SUSE-SU-2024:4407-1 — Security update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative

Security update for aalto-xml, flatten-maven-plugin, jctools, moditect, netty, netty-tcnative

UBUNTU-CVE-2024-47535

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:16.04:LTS: netty-3.9, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:18.04:LTS: netty-3.9, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:22.04:LTS: netty, Ubuntu:24.04:LTS: netty, Ubuntu:25.10: netty, Ubuntu:26.04:LTS: netty

WID-SEC-W-2025-0135 — Oracle Communications Applications: Mehrere Schwachstellen

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.