SB2026080509 - SUSE update for netty, netty-tcnative
Published: August 5, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 19 vulnerabilities.
1) Improper Certificate Validation (CVE-ID: CVE-2026-56820)
CWE-ID: CWE-295 - Improper Certificate Validation
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate revocation checks.
The vulnerability exists due to improper certificate validation in OcspClient validateResponse when processing OCSP responses. A remote attacker can supply a legitimately signed OCSP response for an unrelated certificate to bypass certificate revocation checks.
Exploitation requires access to another valid, non-revoked certificate issued by the same certificate authority as the target certificate.
2) CRLF injection (CVE-ID: CVE-2026-59921)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject arbitrary MIME headers into multipart request parts.
The vulnerability exists due to improper neutralization of CRLF sequences in io.netty.handler.codec.http.multipart.HttpPostRequestEncoder when constructing multipart HTTP request bodies using user-controlled filenames or field names. A remote user can supply a specially crafted filename or form field name to inject arbitrary MIME headers into multipart request parts.
Exploitation requires application use of the multipart encoder with user-controlled filename or field name data that is forwarded without sanitization.
3) CRLF injection (CVE-ID: CVE-2026-59920)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject arbitrary STOMP headers.
The vulnerability exists due to improper neutralization of crlf sequences in io.netty.handler.codec.stomp.StompSubframeEncoder when encoding CONNECT or CONNECTED frame headers with user-controlled newline characters. A remote user can supply a crafted header value containing newline characters to inject arbitrary STOMP headers.
Exploitation requires that user-controlled input is placed into header values and that the downstream STOMP broker processes the injected headers.
4) CRLF injection (CVE-ID: CVE-2026-59919)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to inject arbitrary data in server response.
The vulnerability exists due to insufficient validation of attacker-supplied data within AF_UNIX address. A local user can pass specially crafted data to the application containing CR-LF characters and modify application behavior.
5) Infinite loop (CVE-ID: CVE-2026-59901)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper state management in Bzip2BlockDecompressor.read() when parsing a malformed bzip2 stream. A remote attacker can send a specially crafted compressed stream to cause a denial of service.
The issue can permanently capture the event-loop thread in an infinite loop.
6) Input validation error (CVE-ID: CVE-2026-59900)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass request routing controls.
The vulnerability exists due to improper input validation in Http2StreamFrameToHttpObjectCodec and InboundHttp2ToHttpAdapter when translating HTTP/2 HEADERS frames containing both the :authority pseudo-header and a literal host header. A remote attacker can send a specially crafted HTTP/2 request to bypass request routing controls.
The issue occurs because the translator maps :authority to Host and separately copies the literal host header, resulting in an HttpRequest object with two Host headers containing different attacker-controlled values.
7) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-59899)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in HttpContentEncoder when processing pipelined HTTP/1.1 requests. A remote attacker can send a flood of crafted requests faster than the application produces responses to cause a denial of service.
The issue affects the per-channel acceptEncodingQueue, which accumulates attacker-controlled data on the I/O thread and is drained only when the application writes a non-1xx response.
8) Input validation error (CVE-ID: CVE-2026-59898)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform HTTP request smuggling and protocol-confusion attacks.
The vulnerability exists due to improper input validation in the WebSockets V07/V08 handshaker when handling WebSocket upgrade requests. A remote attacker can send a specially crafted request with Sec-WebSocket-Version: 7 while omitting Connection: Upgrade and Upgrade: websocket headers to perform HTTP request smuggling and protocol-confusion attacks.
The issue affects protocol switching behavior in cases where an intermediary proxy would not recognize the request as a WebSocket upgrade.
9) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-56822)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to a time-of-check time-of-use race condition in OcspServerCertificateValidator when forwarding the TLS handshake completion event before asynchronous OCSP validation completes. A remote attacker can present a revoked server certificate and complete a TLS handshake to disclose sensitive information.
Client applications may send application data or process incoming application data during the interval before the OCSP check closes the channel.
10) Improper Check for Certificate Revocation (CVE-ID: CVE-2026-56821)
CWE-ID: CWE-299 - Improper Check for Certificate Revocation
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass certificate revocation checks.
The vulnerability exists due to improper check for certificate revocation in OcspServerCertificateValidator when processing OCSP responses. A remote attacker can replay a stale GOOD OCSP response to bypass certificate revocation checks.
Nonce validation is optional and disabled by default, leaving response freshness as the only replay defense.
11) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-44891)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in io.netty.handler.codec.stomp.StompSubframeDecoder when parsing STOMP frames with excessive headers. A remote attacker can send a specially crafted STOMP message containing a large number of short headers to cause a denial of service.
The issue can exhaust memory and trigger an OutOfMemoryError in the JVM.
12) Memory leak (CVE-ID: CVE-2026-56819)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in Http2Decompressor.decompress(...) in DelegatingDecompressorFrameListener when processing HTTP/2 DATA frames for a stream whose decompressor channel has already been closed. A remote attacker can send specially crafted HTTP/2 DATA frames to cause a denial of service.
Only applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener are vulnerable.
13) Memory leak (CVE-ID: CVE-2026-56818)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to retain partial aggregate state and cause integrity and availability impacts.
The vulnerability exists due to improper handling of exceptional conditions in RedisArrayAggregator when processing a RESP array header that exceeds the configured maxElements limit. A remote attacker can send a specially crafted Redis message sequence to retain partial aggregate state and cause integrity and availability impacts.
Exploitation requires the application to keep the channel alive after the decoder exception so that later messages are consumed into the stale aggregate state.
14) XML External Entity injection (CVE-ID: CVE-2026-56817)
CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject XML entities.
The vulnerability exists due to improper configuration in XmlDecoder when parsing XML containing a DOCTYPE declaration. A remote attacker can send specially crafted XML data to inject XML entities.
Whether external entities are actually resolved depends on Aalto XML's asynchronous parser behavior, making exploitability conditional.
15) Improper access control (CVE-ID: CVE-2026-56746)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to a logical operator error in the origin evaluation process. A remote attacker can send a specially crafted request to bypass the short-circuit mechanism.
16) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-56745)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper resource management in the SpdyHttpDecoder handler when processing a client-initiated SYN_STREAM frame followed by an RST_STREAM frame or oversized content. A remote attacker can send crafted SPDY frames to cause a denial of service.
The issue leaks a pooled ByteBuf by removing the partially constructed FullHttpRequest from an internal map without releasing the underlying buffer.
17) Infinite loop (CVE-ID: CVE-2026-55851)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper handling of a signed-byte sentinel collision in HAProxyMessageDecoder when processing a crafted PROXY protocol v2 header. A remote attacker can send a specially crafted PROXY protocol v2 prefix followed by a version byte of 0xff to cause a denial of service.
The issue can trap version detection in a loop that prevents header size limits from being enforced and causes inbound bytes to accumulate in an unbounded buffer until direct memory is exhausted.
18) Input validation error (CVE-ID: CVE-2026-55833)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in the SPDY header decoder in SpdyFrameCodec when processing zlib-compressed SPDY header blocks after maxHeaderSize truncation. A remote attacker can send a specially crafted HEADERS frame to cause a denial of service.
Exploitation requires a reachable SPDY pipeline using SpdyFrameCodec and a decoder path that selects the zlib decoder.
19) Resource exhaustion (CVE-ID: CVE-2026-55831)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in DefaultSpdySettingsFrame settings map handling when processing a crafted SPDY/3.1 SETTINGS frame. A remote attacker can send a specially crafted SETTINGS frame to cause a denial of service.
Exploitation requires the target to accept SPDY/3.1 traffic through a Netty pipeline containing SpdyFrameCodec.
Remediation
Install update from vendor's website.