SB2026071505 - Multiple vulnerabilities in Netty

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026071505

SB2026071505 - Multiple vulnerabilities in Netty

Published: July 15, 2026

Security Bulletin ID SB2026071505
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 88% Low 12%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Infinite loop (CVE-ID: CVE-2026-55851)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of a signed-byte sentinel collision in HAProxyMessageDecoder when processing a crafted PROXY protocol v2 header. A remote attacker can send a specially crafted PROXY protocol v2 prefix followed by a version byte of 0xff to cause a denial of service.

The issue can trap version detection in a loop that prevents header size limits from being enforced and causes inbound bytes to accumulate in an unbounded buffer until direct memory is exhausted.


2) CRLF injection (CVE-ID: CVE-2026-59920)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject arbitrary STOMP headers.

The vulnerability exists due to improper neutralization of crlf sequences in io.netty.handler.codec.stomp.StompSubframeEncoder when encoding CONNECT or CONNECTED frame headers with user-controlled newline characters. A remote user can supply a crafted header value containing newline characters to inject arbitrary STOMP headers.

Exploitation requires that user-controlled input is placed into header values and that the downstream STOMP broker processes the injected headers.


3) CRLF injection (CVE-ID: CVE-2026-59921)

CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to inject arbitrary MIME headers into multipart request parts.

The vulnerability exists due to improper neutralization of CRLF sequences in io.netty.handler.codec.http.multipart.HttpPostRequestEncoder when constructing multipart HTTP request bodies using user-controlled filenames or field names. A remote user can supply a specially crafted filename or form field name to inject arbitrary MIME headers into multipart request parts.

Exploitation requires application use of the multipart encoder with user-controlled filename or field name data that is forwarded without sanitization.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-44891)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in io.netty.handler.codec.stomp.StompSubframeDecoder when parsing STOMP frames with excessive headers. A remote attacker can send a specially crafted STOMP message containing a large number of short headers to cause a denial of service.

The issue can exhaust memory and trigger an OutOfMemoryError in the JVM.


5) Improper Certificate Validation (CVE-ID: CVE-2026-56820)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass certificate revocation checks.

The vulnerability exists due to improper certificate validation in OcspClient validateResponse when processing OCSP responses. A remote attacker can supply a legitimately signed OCSP response for an unrelated certificate to bypass certificate revocation checks.

Exploitation requires access to another valid, non-revoked certificate issued by the same certificate authority as the target certificate.


6) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-56822)

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to a time-of-check time-of-use race condition in OcspServerCertificateValidator when forwarding the TLS handshake completion event before asynchronous OCSP validation completes. A remote attacker can present a revoked server certificate and complete a TLS handshake to disclose sensitive information.

Client applications may send application data or process incoming application data during the interval before the OCSP check closes the channel.


7) Resource exhaustion (CVE-ID: CVE-2026-55831)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in DefaultSpdySettingsFrame settings map handling when processing a crafted SPDY/3.1 SETTINGS frame. A remote attacker can send a specially crafted SETTINGS frame to cause a denial of service.

Exploitation requires the target to accept SPDY/3.1 traffic through a Netty pipeline containing SpdyFrameCodec.


8) Input validation error (CVE-ID: CVE-2026-55833)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the SPDY header decoder in SpdyFrameCodec when processing zlib-compressed SPDY header blocks after maxHeaderSize truncation. A remote attacker can send a specially crafted HEADERS frame to cause a denial of service.

Exploitation requires a reachable SPDY pipeline using SpdyFrameCodec and a decoder path that selects the zlib decoder.


9) Resource exhaustion (CVE-ID: CVE-2026-56816)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Http3FrameCodec when processing HTTP/3 reserved frames. A remote attacker can send specially crafted reserved frames with large payload lengths across multiple QUIC streams to cause a denial of service.

The payload length is read directly from the wire without validation, which can lead to gradual memory exhaustion and out-of-memory conditions.


10) Input validation error (CVE-ID: CVE-2026-59898)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform HTTP request smuggling and protocol-confusion attacks.

The vulnerability exists due to improper input validation in the WebSockets V07/V08 handshaker when handling WebSocket upgrade requests. A remote attacker can send a specially crafted request with Sec-WebSocket-Version: 7 while omitting Connection: Upgrade and Upgrade: websocket headers to perform HTTP request smuggling and protocol-confusion attacks.

The issue affects protocol switching behavior in cases where an intermediary proxy would not recognize the request as a WebSocket upgrade.


11) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-56745)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the SpdyHttpDecoder handler when processing a client-initiated SYN_STREAM frame followed by an RST_STREAM frame or oversized content. A remote attacker can send crafted SPDY frames to cause a denial of service.

The issue leaks a pooled ByteBuf by removing the partially constructed FullHttpRequest from an internal map without releasing the underlying buffer.


12) Memory leak (CVE-ID: CVE-2026-56819)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in Http2Decompressor.decompress(...) in DelegatingDecompressorFrameListener when processing HTTP/2 DATA frames for a stream whose decompressor channel has already been closed. A remote attacker can send specially crafted HTTP/2 DATA frames to cause a denial of service.

Only applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener are vulnerable.


13) XML External Entity injection (CVE-ID: CVE-2026-56817)

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject XML entities.

The vulnerability exists due to improper configuration in XmlDecoder when parsing XML containing a DOCTYPE declaration. A remote attacker can send specially crafted XML data to inject XML entities.

Whether external entities are actually resolved depends on Aalto XML's asynchronous parser behavior, making exploitability conditional.


14) Improper Check for Certificate Revocation (CVE-ID: CVE-2026-56821)

CWE-ID: CWE-299 - Improper Check for Certificate Revocation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass certificate revocation checks.

The vulnerability exists due to improper check for certificate revocation in OcspServerCertificateValidator when processing OCSP responses. A remote attacker can replay a stale GOOD OCSP response to bypass certificate revocation checks.

Nonce validation is optional and disabled by default, leaving response freshness as the only replay defense.


15) Infinite loop (CVE-ID: CVE-2026-59901)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper state management in Bzip2BlockDecompressor.read() when parsing a malformed bzip2 stream. A remote attacker can send a specially crafted compressed stream to cause a denial of service.

The issue can permanently capture the event-loop thread in an infinite loop.


16) Input validation error (CVE-ID: CVE-2026-59900)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass request routing controls.

The vulnerability exists due to improper input validation in Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter when translating HTTP/2 HEADERS frames containing both the :authority pseudo-header and a literal host header. A remote attacker can send a specially crafted HTTP/2 request to bypass request routing controls.

The issue occurs because the translator maps :authority to Host and separately copies the literal host header, resulting in an HttpRequest object with two Host headers containing different attacker-controlled values.


17) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59899)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in HttpContentEncoder when processing pipelined HTTP/1.1 requests. A remote attacker can send a flood of crafted requests faster than the application produces responses to cause a denial of service.

The issue affects the per-channel acceptEncodingQueue, which accumulates attacker-controlled data on the I/O thread and is drained only when the application writes a non-1xx response.


Remediation

Install update from vendor's website.

References