Most recent entries from all

bdu:2026-09787

certfr-2026-avi-0773 — De multiples vulnérabilités ont été découvertes dans les produits Atlassian. Certaines d'entre elles permettent à un at…

certfr-2026-avi-0773

Withdrawn: CLEANSTART-2026-AB08507 — Security fixes for CVE-2026-42583, ghsa-72hv-8253-57qq, ghsa-mj4r-2hfc-f8p6 applied in versions: 3.8.6-r0, 3.8.6-r1

Withdrawn by the publisher.

Affected: CleanStart: apache-zookeeper

Multiple security vulnerabilities affect the apache-zookeeper package. These issues are resolved in later releases. See references for individual vulnerability details.

EUVD-2026-318537

fkie_cve-2026-42583

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

GHSA-mj4r-2hfc-f8p6 — Netty Lz4FrameDecoder is vulnerable to resource exhaustion

Affected: Maven: io.netty:netty-codec-compression, Maven: io.netty:netty-codec

### Summary Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus `compressedLength` payload bytes - 22 bytes if `compressedLength == 1` - to force that allocation.

### Details io.netty.handler.codec.compression.Lz4FrameDecoder#decode Header fields are trusted for sizing. On the compressed path, after `readableBytes >= compressedLength`, the decoder does `ctx.alloc().buffer(decompressedLength, decompressedLength)` then decompresses.

### PoC The test below demonstrates how an attacker sending 22 bytes will force the server to allocate 32MB

```java @Test void test() throws Exception { EventLoopGroup workerGroup = new MultiThreadIoEventLoopGroup(NioIoHandler.newFactory()); try { AtomicReference<Throwable> serverError = new AtomicReference<>(); CountDownLatch latch = new CountDownLatch(1);

ServerBootstrap server = new ServerBootstrap() .group(workerGroup) .channel(NioServerSocketChannel.class) .childHandler(new ChannelInitializer<SocketChannel>() { @Override protected void initChannel(SocketChannel ch) { ch.pipeline() .addLast(new Lz4FrameDecoder()) .addLast(new ChannelInboundHandlerAdapter() {…

NCSC-2026-0325 — Kwetsbaarheden verholpen in Atlassian producten

NCSC-2026-0325

openSUSE-SU-2026:10795-1 — netty-4.1.133-1.1 on GA media

netty-4.1.133-1.1 on GA media

RHSA-2026:34608 — Red Hat Security Advisory: Streams for Apache Kafka 2.9.4 release and security update

jose4j: jose4j: Denial of Service via malicious JSON Web Encryption (JWE) token compression lodash: prototype pollution in _.unset and _.omit functions netty-codec-http: Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files lodash: lodash: Arbitrary code execution via untrusted input in template imports eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name react-server-dom-webpack: react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests Apache ZooKeeper: Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing Apache ZooKeeper: Apache ZooKeeper: Information disclosure via improper handling of configuration values next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests DOMPurify: DOMPurify: Cross-Site Scripting (XSS) via inconsistent tag sanitization ax…

Withdrawn: UBUNTU-CVE-2026-42583

Withdrawn by the publisher.

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:25.10: netty, Ubuntu:Pro:26.04:LTS: netty

WID-SEC-W-2026-1372 — Netty: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.