OPENSUSE-SU-2026:11394-1
Vulnerability from csaf_opensuse - Published: 2026-07-28 00:00 - Updated: 2026-09-16 21:24Summary
netty-4.1.136-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: netty-4.1.136-1.1 on GA media
Description of the patch: These are all security issues fixed in the netty-4.1.136-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11394
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.136-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
7.4 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
7.4 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
7.4 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
5.4 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
moderate
7.2 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
important
5.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
moderate
5.7 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-44891
Threats
Impact
moderate
References
59 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "netty-4.1.136-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the netty-4.1.136-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11394",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11394-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-44891 page",
"url": "https://www.suse.com/security/cve/CVE-2026-44891/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-55851 page",
"url": "https://www.suse.com/security/cve/CVE-2026-55851/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56745 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56745/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56746 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56746/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56817 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56817/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56818 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56818/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56819 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56820 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56820/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-56822 page",
"url": "https://www.suse.com/security/cve/CVE-2026-56822/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59898 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59898/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59899 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59899/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59900 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59900/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59901 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59901/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59919 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59919/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59920 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59920/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59921 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59921/"
}
],
"title": "netty-4.1.136-1.1 on GA media",
"tracking": {
"current_release_date": "2026-09-16T21:24:00Z",
"generator": {
"date": "2026-07-28T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11394-1",
"initial_release_date": "2026-07-28T00:00:00Z",
"revision_history": [
{
"date": "2026-07-28T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T20:21:26Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T21:24:00Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.136-1.1.aarch64",
"product": {
"name": "netty-4.1.136-1.1.aarch64",
"product_id": "netty-4.1.136-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.136:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty@4.1.136-1.1?arch=aarch64\u0026upstream=netty-4.1.136-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.136-1.1.aarch64",
"product": {
"name": "netty-bom-4.1.136-1.1.aarch64",
"product_id": "netty-bom-4.1.136-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-bom@4.1.136-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.136-1.1.aarch64",
"product": {
"name": "netty-javadoc-4.1.136-1.1.aarch64",
"product_id": "netty-javadoc-4.1.136-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.136:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty-javadoc@4.1.136-1.1?arch=aarch64\u0026upstream=netty-4.1.136-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.136-1.1.aarch64",
"product": {
"name": "netty-parent-4.1.136-1.1.aarch64",
"product_id": "netty-parent-4.1.136-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-parent@4.1.136-1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.136-1.1.ppc64le",
"product": {
"name": "netty-4.1.136-1.1.ppc64le",
"product_id": "netty-4.1.136-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.136:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty@4.1.136-1.1?arch=ppc64le\u0026upstream=netty-4.1.136-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.136-1.1.ppc64le",
"product": {
"name": "netty-bom-4.1.136-1.1.ppc64le",
"product_id": "netty-bom-4.1.136-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-bom@4.1.136-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.136-1.1.ppc64le",
"product": {
"name": "netty-javadoc-4.1.136-1.1.ppc64le",
"product_id": "netty-javadoc-4.1.136-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.136:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty-javadoc@4.1.136-1.1?arch=ppc64le\u0026upstream=netty-4.1.136-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.136-1.1.ppc64le",
"product": {
"name": "netty-parent-4.1.136-1.1.ppc64le",
"product_id": "netty-parent-4.1.136-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-parent@4.1.136-1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.136-1.1.s390x",
"product": {
"name": "netty-4.1.136-1.1.s390x",
"product_id": "netty-4.1.136-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.136:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty@4.1.136-1.1?arch=s390x\u0026upstream=netty-4.1.136-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.136-1.1.s390x",
"product": {
"name": "netty-bom-4.1.136-1.1.s390x",
"product_id": "netty-bom-4.1.136-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-bom@4.1.136-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.136-1.1.s390x",
"product": {
"name": "netty-javadoc-4.1.136-1.1.s390x",
"product_id": "netty-javadoc-4.1.136-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.136:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty-javadoc@4.1.136-1.1?arch=s390x\u0026upstream=netty-4.1.136-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.136-1.1.s390x",
"product": {
"name": "netty-parent-4.1.136-1.1.s390x",
"product_id": "netty-parent-4.1.136-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-parent@4.1.136-1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.136-1.1.x86_64",
"product": {
"name": "netty-4.1.136-1.1.x86_64",
"product_id": "netty-4.1.136-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.136:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty@4.1.136-1.1?arch=x86_64\u0026upstream=netty-4.1.136-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.136-1.1.x86_64",
"product": {
"name": "netty-bom-4.1.136-1.1.x86_64",
"product_id": "netty-bom-4.1.136-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-bom@4.1.136-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.136-1.1.x86_64",
"product": {
"name": "netty-javadoc-4.1.136-1.1.x86_64",
"product_id": "netty-javadoc-4.1.136-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.136:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty-javadoc@4.1.136-1.1?arch=x86_64\u0026upstream=netty-4.1.136-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.136-1.1.x86_64",
"product": {
"name": "netty-parent-4.1.136-1.1.x86_64",
"product_id": "netty-parent-4.1.136-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-parent@4.1.136-1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.136-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64"
},
"product_reference": "netty-4.1.136-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.136-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le"
},
"product_reference": "netty-4.1.136-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.136-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.136-1.1.s390x"
},
"product_reference": "netty-4.1.136-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.136-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64"
},
"product_reference": "netty-4.1.136-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.136-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64"
},
"product_reference": "netty-bom-4.1.136-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.136-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le"
},
"product_reference": "netty-bom-4.1.136-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.136-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x"
},
"product_reference": "netty-bom-4.1.136-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.136-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64"
},
"product_reference": "netty-bom-4.1.136-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.136-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64"
},
"product_reference": "netty-javadoc-4.1.136-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.136-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le"
},
"product_reference": "netty-javadoc-4.1.136-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.136-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x"
},
"product_reference": "netty-javadoc-4.1.136-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.136-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64"
},
"product_reference": "netty-javadoc-4.1.136-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.136-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64"
},
"product_reference": "netty-parent-4.1.136-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.136-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le"
},
"product_reference": "netty-parent-4.1.136-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.136-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x"
},
"product_reference": "netty-parent-4.1.136-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.136-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
},
"product_reference": "netty-parent-4.1.136-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-44891",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-44891"
}
],
"notes": [
{
"category": "general",
"text": "Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-44891",
"url": "https://www.suse.com/security/cve/CVE-2026-44891"
},
{
"category": "external",
"summary": "SUSE Bug 1271435 for CVE-2026-44891",
"url": "https://bugzilla.suse.com/1271435"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-44891"
},
{
"cve": "CVE-2026-55831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55831"
}
],
"notes": [
{
"category": "general",
"text": "Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty\u0027s SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55831",
"url": "https://www.suse.com/security/cve/CVE-2026-55831"
},
{
"category": "external",
"summary": "SUSE Bug 1271960 for CVE-2026-55831",
"url": "https://bugzilla.suse.com/1271960"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-55831"
},
{
"cve": "CVE-2026-55833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55833"
}
],
"notes": [
{
"category": "general",
"text": "Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55833",
"url": "https://www.suse.com/security/cve/CVE-2026-55833"
},
{
"category": "external",
"summary": "SUSE Bug 1271961 for CVE-2026-55833",
"url": "https://bugzilla.suse.com/1271961"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-55833"
},
{
"cve": "CVE-2026-55851",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-55851"
}
],
"notes": [
{
"category": "general",
"text": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty\u0027s `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder\u0027s need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-55851",
"url": "https://www.suse.com/security/cve/CVE-2026-55851"
},
{
"category": "external",
"summary": "SUSE Bug 1272253 for CVE-2026-55851",
"url": "https://bugzilla.suse.com/1272253"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-55851"
},
{
"cve": "CVE-2026-56745",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56745"
}
],
"notes": [
{
"category": "general",
"text": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty\u0027s SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56745",
"url": "https://www.suse.com/security/cve/CVE-2026-56745"
},
{
"category": "external",
"summary": "SUSE Bug 1272254 for CVE-2026-56745",
"url": "https://bugzilla.suse.com/1272254"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56745"
},
{
"cve": "CVE-2026-56746",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56746"
}
],
"notes": [
{
"category": "general",
"text": "Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56746",
"url": "https://www.suse.com/security/cve/CVE-2026-56746"
},
{
"category": "external",
"summary": "SUSE Bug 1272255 for CVE-2026-56746",
"url": "https://bugzilla.suse.com/1272255"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-56746"
},
{
"cve": "CVE-2026-56817",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56817"
}
],
"notes": [
{
"category": "general",
"text": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56817",
"url": "https://www.suse.com/security/cve/CVE-2026-56817"
},
{
"category": "external",
"summary": "SUSE Bug 1272257 for CVE-2026-56817",
"url": "https://bugzilla.suse.com/1272257"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-56817"
},
{
"cve": "CVE-2026-56818",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56818"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nested array header longer than the configured maxElements. Netty throws a decoder exception in decodeRedisArrayHeader, but the existing partial aggregate remains retained in the handler. If the application leaves the channel alive after the exception, later messages are still consumed into the pre-error aggregate, allowing an unauthenticated peer to keep attacker-controlled aggregate state alive across a security-limit exception and pin retained pooled buffers. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56818",
"url": "https://www.suse.com/security/cve/CVE-2026-56818"
},
{
"category": "external",
"summary": "SUSE Bug 1272603 for CVE-2026-56818",
"url": "https://bugzilla.suse.com/1272603"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-56818"
},
{
"cve": "CVE-2026-56819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56819"
}
],
"notes": [
{
"category": "general",
"text": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56819",
"url": "https://www.suse.com/security/cve/CVE-2026-56819"
},
{
"category": "external",
"summary": "SUSE Bug 1272258 for CVE-2026-56819",
"url": "https://bugzilla.suse.com/1272258"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56819"
},
{
"cve": "CVE-2026-56820",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56820"
}
],
"notes": [
{
"category": "general",
"text": "Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56820",
"url": "https://www.suse.com/security/cve/CVE-2026-56820"
},
{
"category": "external",
"summary": "SUSE Bug 1272259 for CVE-2026-56820",
"url": "https://bugzilla.suse.com/1272259"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56820"
},
{
"cve": "CVE-2026-56821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56821"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56821",
"url": "https://www.suse.com/security/cve/CVE-2026-56821"
},
{
"category": "external",
"summary": "SUSE Bug 1272299 for CVE-2026-56821",
"url": "https://bugzilla.suse.com/1272299"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56821"
},
{
"cve": "CVE-2026-56822",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-56822"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client\u0027s downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check. n io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an SslHandshakeCompletionEvent is received, the validator immediately calls ctx.fireUserEventTriggered(evt). It then initiates an asynchronous OCSP query using OcspClient.query. Because the handshake completion event is forwarded immediately, downstream handlers in the client\u0027s pipeline are notified that the TLS handshake is successful. They may then begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates the server\u0027s certificate is REVOKED, the validator closes the channel, but by this time, the client may have already leaked sensitive data to a revoked server or processed malicious responses from it. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-56822",
"url": "https://www.suse.com/security/cve/CVE-2026-56822"
},
{
"category": "external",
"summary": "SUSE Bug 1272300 for CVE-2026-56822",
"url": "https://bugzilla.suse.com/1272300"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-56822"
},
{
"cve": "CVE-2026-59898",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59898"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59898",
"url": "https://www.suse.com/security/cve/CVE-2026-59898"
},
{
"category": "external",
"summary": "SUSE Bug 1272302 for CVE-2026-59898",
"url": "https://bugzilla.suse.com/1272302"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-59898"
},
{
"cve": "CVE-2026-59899",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59899"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque\u003cCharSequence\u003e` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59899",
"url": "https://www.suse.com/security/cve/CVE-2026-59899"
},
{
"category": "external",
"summary": "SUSE Bug 1272301 for CVE-2026-59899",
"url": "https://bugzilla.suse.com/1272301"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-59899"
},
{
"cve": "CVE-2026-59900",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59900"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty\u0027s HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59900",
"url": "https://www.suse.com/security/cve/CVE-2026-59900"
},
{
"category": "external",
"summary": "SUSE Bug 1272303 for CVE-2026-59900",
"url": "https://bugzilla.suse.com/1272303"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-59900"
},
{
"cve": "CVE-2026-59901",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59901"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty\u0027s compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59901",
"url": "https://www.suse.com/security/cve/CVE-2026-59901"
},
{
"category": "external",
"summary": "SUSE Bug 1272304 for CVE-2026-59901",
"url": "https://bugzilla.suse.com/1272304"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-59901"
},
{
"cve": "CVE-2026-59919",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59919"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty\u0027s HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \\r\\n sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59919",
"url": "https://www.suse.com/security/cve/CVE-2026-59919"
},
{
"category": "external",
"summary": "SUSE Bug 1272305 for CVE-2026-59919",
"url": "https://bugzilla.suse.com/1272305"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-59919"
},
{
"cve": "CVE-2026-59920",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59920"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty\u0027s STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \\n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59920",
"url": "https://www.suse.com/security/cve/CVE-2026-59920"
},
{
"category": "external",
"summary": "SUSE Bug 1272306 for CVE-2026-59920",
"url": "https://bugzilla.suse.com/1272306"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-59920"
},
{
"cve": "CVE-2026-59921",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59921"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\\r\\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations\u0027 setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59921",
"url": "https://www.suse.com/security/cve/CVE-2026-59921"
},
{
"category": "external",
"summary": "SUSE Bug 1272307 for CVE-2026-59921",
"url": "https://bugzilla.suse.com/1272307"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.136-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.136-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-07-28T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-59921"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…