Source: netty Version: 1:4.1.48-16 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for netty. CVE-2026-93488[0]: | A flaw was found in Netty. SpdySessionHandler accepts an unlimited | number of concurrent remote-initiated streams because | localConcurrentStreams defaults to Integer.MAX_VALUE and the handler | provides no API to change it. A remote peer can open a SPDY | connection and send a large number of SYN_STREAM frames with | FLAG_FIN=0, causing unbounded heap and direct memory allocation that | can lead to JVM OutOfMemoryError and a denial of service. CVE-2026-93491[1]: | A flaw was found in Netty's HttpServerCodec. A remote, | unauthenticated attacker can exploit this vulnerability by | pipelining HTTP/1.1 requests on a single connection and withholding | reads. This action causes the methodOverflowQueue to grow without | limit, leading to unbounded heap memory consumption and a denial of | service due to memory exhaustion. CVE-2026-93492[2]: | A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker | can exploit this by sending HTTP/2 SETTINGS frames with a very large | MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an | excessive number of unique headers, leading to increased CPU usage | and memory consumption, ultimately resulting in a Denial of Service | (DoS). CVE-2026-93493[3]: | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A | remote attacker can exploit this vulnerability by providing an | Online Certificate Status Protocol (OCSP) response that omits the | optional `nextUpdate` field. This omission causes the OCSP | validation to be silently skipped, leading to applications | proceeding with an unvalidated certificate. This can result in a | bypass of security controls where certificate validation is | expected. CVE-2026-93494[4]: | A flaw was found in Netty's StompSubframeDecoder component. A remote | attacker can exploit this vulnerability by sending a specially | crafted STOMP frame body without its terminating null byte. This | causes the decoder to allocate a ByteBuf (a buffer for bytes) that | is never released, leading to a permanent memory leak. Over time, | this uncontrolled memory consumption can result in a Denial of | Service (DoS) for the application using the affected STOMP codec. CVE-2026-93558[5]: | A flaw was found in Netty's WebSocketServerExtensionHandler. A | remote, unauthenticated attacker can exploit this vulnerability by | using HTTP/1.1 pipelining to send requests faster than the | application can respond. This leads to an unbounded growth of a per- | connection queue, consuming excessive memory. Eventually, this can | cause the Java Virtual Machine (JVM) to exhaust its heap, resulting | in a Denial of Service (DoS) for the affected server. CVE-2026-93560[6]: | A flaw was found in the Netty STOMP codec. A remote attacker could | send a specially crafted STOMP frame with a content-length header | exceeding the maximum integer value. This integer truncation | vulnerability could lead to an infinite decode loop, causing a | Denial of Service (DoS) by exhausting memory and CPU resources. CVE-2026-93561[7]: | A flaw was found in io.netty/netty-codec-memcache. The Memcache | binary protocol codec incorrectly reads `keyLength` and | `extrasLength` as signed Java types instead of unsigned, as | specified by the protocol. A malicious Memcache server can exploit | this type mismatch by sending a specially crafted response. This can | lead to frame desynchronization and response smuggling, where one | client's data may be inadvertently exposed to another client's | response stream in proxy or cache environments. CVE-2026-93562[8]: | A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of | malformed Transfer-Encoding headers allows a remote attacker to | perform HTTP request smuggling. By sending specially crafted HTTP | requests, an attacker can inject arbitrary HTTP requests, | potentially bypassing security controls or accessing unauthorized | resources. CVE-2026-93563[9]: | A flaw was found in Netty's `SmtpResponseDecoder` component. A | remote attacker, acting as a malicious or man-in-the-middle (MITM) | SMTP server, could exploit this by sending a specially crafted, | unbounded multi-line SMTP response without a terminator. This | vulnerability leads to unbounded memory accumulation within the | client's Java Virtual Machine (JVM) heap, causing an | `OutOfMemoryError` and a denial of service (DoS) due to a process | crash. CVE-2026-93564[10]: | A flaw was found in Netty. A reference-count leak in the HAProxy | PROXY-v2 message decoder allows a remote, unauthenticated attacker | to send specially crafted PROXY-protocol v2 headers. This can lead | to memory exhaustion, resulting in a Denial of Service (DoS) for the | affected system. CVE-2026-93565[11]: | A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` | function incorrectly strips trailing control bytes from method | tokens in Real-Time Streaming Protocol (RTSP) requests. A remote | attacker can exploit this by sending a specially crafted RTSP | request, leading to method-token smuggling. This vulnerability | allows an attacker to bypass method-based access controls and can | also be used to launder malicious requests through Netty-based RTSP | proxies, making them appear legitimate to backend systems. CVE-2026-93566[12]: | A flaw was found in Netty. A remote attacker could exploit this by | sending a specially crafted HTTP request that includes control | characters within the chunk-size line. This bypasses the intended | strict validation, allowing the attacker to inject arbitrary HTTP | requests. This vulnerability can lead to HTTP request smuggling, | potentially resulting in information disclosure or other | unauthorized actions. CVE-2026-93567[13]: | A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 | CONNECT requests to HTTP/2, the component incorrectly uses the Host | header instead of the CONNECT authority-form request-target for the | tunnel authority. A remote attacker can exploit this by supplying a | different Host header, leading to a malformed HTTP/2 CONNECT | request. This can bypass security controls such as tunnel allow- | lists or egress policies, resulting in integrity loss. CVE-2026-93568[14]: | A flaw was found in Netty. A remote attacker could exploit this | vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended | CONNECT requests. Netty's HTTP-object conversion path incorrectly | processes these requests as regular HTTP/1.1 CONNECT requests, | leading to a loss of critical protocol and path information. This | misinterpretation can allow attackers to bypass security policies, | such as routing or authorization logic, in applications that rely on | Netty for HTTP/2 or HTTP/3 communication, resulting in integrity | loss. CVE-2026-93569[15]: | A flaw was found in Netty. A remote unauthenticated attacker can | exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion | process. When an HTTP/1 request includes both an absolute-form | request-target and a conflicting Host header, Netty incorrectly | prioritizes the Host header for the HTTP/2 :authority field, | discarding the original request-target authority. This inconsistency | can allow an attacker to bypass security controls in Netty-based | proxies or gateways, potentially leading to unauthorized access, | cache poisoning, or misrouting of requests. CVE-2026-93572[16]: | A flaw was found in Netty's `RedisArrayAggregator` component. A | remote attacker can exploit this vulnerability by sending specially | crafted nested Redis (RESP) array headers. This can cause the | `RedisArrayAggregator` to eagerly preallocate a large amount of heap | memory, leading to heap memory exhaustion and a Denial of Service | (DoS) for applications using `RedisDecoder` with | `RedisArrayAggregator` on untrusted traffic. CVE-2026-93573[17]: | A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability | allows a remote attacker to bypass `Transfer-Encoding` header | validation by splitting the `Transfer-Encoding` field across | multiple headers, with the last field containing a non-final | transfer coding like `gzip` or `deflate`. This bypass can lead to | HTTP request smuggling, enabling attackers to bypass security | controls, desynchronize request processing, or cause requests to be | processed in an unintended context. CVE-2026-93574[18]: | A flaw was found in Netty's `netty-codec-http` component. A remote | attacker could exploit this vulnerability by sending a specially | crafted HTTP/1.1 chunk-size token that includes post-digit | whitespace. This incorrect parsing of the chunk size can lead to | HTTP request smuggling. This allows an attacker to bypass security | controls or access unauthorized resources in proxy/backend | deployments. CVE-2026-93575[19]: | A flaw was found in Netty's MqttDecoder. An unauthenticated remote | attacker can exploit this vulnerability by sending a specially | crafted MQTT CONNECT packet. The decoder fails to properly validate | the 'Properties Length' against the 'Remaining Length', allowing an | attacker to bypass size limits. This leads to excessive memory and | CPU consumption, resulting in a denial of service (DoS) due to an | OutOfMemoryError. CVE-2026-93576[20]: | A flaw was found in Netty netty-codec-smtp. The component does not | properly validate Carriage Return (CR) and Line Feed (LF) characters | in the SMTP command-name field. A remote attacker, if an application | routes untrusted input into this field, can embed CR/LF characters | to inject arbitrary SMTP commands. This can lead to SMTP command | smuggling, allowing for unauthorized email relay or spoofing of | sender/recipient addresses. While the impact is significant, the | real-world exploitability is considered lower as applications | typically do not place user-controlled data in the command-name | field. CVE-2026-93578[21]: | A flaw was found in Netty's Online Certificate Status Protocol | (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' | Extended Key Usage (EKU) in OCSP responder certificates. A remote | attacker, holding any valid certificate issued by the same | Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP | responses for revoked certificates. This bypasses certificate | revocation checks, allowing applications using Netty's OCSP Client | to accept certificates that should have been revoked, leading to an | authorization bypass. CVE-2026-93579[22]: | A flaw was found in Netty's HTTP/2 stack. This vulnerability allows | a remote attacker to inject prohibited characters, such as NUL, Line | Feed, and Carriage Return, into HTTP/2 header field values due to | insufficient validation. When these values cross an HTTP/2 to | HTTP/1.1 translation boundary, they can be exploited for request | smuggling, header injection, or response splitting. This could lead | to unauthorized access, data manipulation, or other security | bypasses. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-93488 https://www.cve.org/CVERecord?id=CVE-2026-93488 [1] https://security-tracker.debian.org/tracker/CVE-2026-93491 https://www.cve.org/CVERecord?id=CVE-2026-93491 [2] https://security-tracker.debian.org/tracker/CVE-2026-93492 https://www.cve.org/CVERecord?id=CVE-2026-93492 [3] https://security-tracker.debian.org/tracker/CVE-2026-93493 https://www.cve.org/CVERecord?id=CVE-2026-93493 [4] https://security-tracker.debian.org/tracker/CVE-2026-93494 https://www.cve.org/CVERecord?id=CVE-2026-93494 [5] https://security-tracker.debian.org/tracker/CVE-2026-93558 https://www.cve.org/CVERecord?id=CVE-2026-93558 [6] https://security-tracker.debian.org/tracker/CVE-2026-93560 https://www.cve.org/CVERecord?id=CVE-2026-93560 [7] https://security-tracker.debian.org/tracker/CVE-2026-93561 https://www.cve.org/CVERecord?id=CVE-2026-93561 [8] https://security-tracker.debian.org/tracker/CVE-2026-93562 https://www.cve.org/CVERecord?id=CVE-2026-93562 [9] https://security-tracker.debian.org/tracker/CVE-2026-93563 https://www.cve.org/CVERecord?id=CVE-2026-93563 [10] https://security-tracker.debian.org/tracker/CVE-2026-93564 https://www.cve.org/CVERecord?id=CVE-2026-93564 [11] https://security-tracker.debian.org/tracker/CVE-2026-93565 https://www.cve.org/CVERecord?id=CVE-2026-93565 [12] https://security-tracker.debian.org/tracker/CVE-2026-93566 https://www.cve.org/CVERecord?id=CVE-2026-93566 [13] https://security-tracker.debian.org/tracker/CVE-2026-93567 https://www.cve.org/CVERecord?id=CVE-2026-93567 [14] https://security-tracker.debian.org/tracker/CVE-2026-93568 https://www.cve.org/CVERecord?id=CVE-2026-93568 [15] https://security-tracker.debian.org/tracker/CVE-2026-93569 https://www.cve.org/CVERecord?id=CVE-2026-93569 [16] https://security-tracker.debian.org/tracker/CVE-2026-93572 https://www.cve.org/CVERecord?id=CVE-2026-93572 [17] https://security-tracker.debian.org/tracker/CVE-2026-93573 https://www.cve.org/CVERecord?id=CVE-2026-93573 [18] https://security-tracker.debian.org/tracker/CVE-2026-93574 https://www.cve.org/CVERecord?id=CVE-2026-93574 [19] https://security-tracker.debian.org/tracker/CVE-2026-93575 https://www.cve.org/CVERecord?id=CVE-2026-93575 [20] https://security-tracker.debian.org/tracker/CVE-2026-93576 https://www.cve.org/CVERecord?id=CVE-2026-93576 [21] https://security-tracker.debian.org/tracker/CVE-2026-93578 https://www.cve.org/CVERecord?id=CVE-2026-93578 [22] https://security-tracker.debian.org/tracker/CVE-2026-93579 https://www.cve.org/CVERecord?id=CVE-2026-93579 Regards, Salvatore
