Source: netty Version: 1:4.1.48-16 Severity: grave Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for netty. CVE-2026-44891[0]: | Netty is a network application framework for development of protocol | servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, | io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the | total number of headers or their cumulative size per frame, and the | maxLineLength parameter only restricts individual header lines. An | attacker can send a large number of short headers that are | accumulated in memory inside DefaultStompHeadersSubframe until the | JVM throws an OutOfMemoryError, causing denial of service for | servers exposing a STOMP endpoint based on StompSubframeDecoder. | This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. CVE-2026-55831[1]: | Netty is a network application framework for development of protocol | servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, | Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry | count up to the 24-bit frame-length limit and materializes every | unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote | SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS | frame that creates 262144 map entries and amplifies network input | into heap growth and ordered-map insertion work. This issue is fixed | in versions 4.1.136.Final and 4.2.16.Final. CVE-2026-55833[2]: | Netty is a network application framework for development of protocol | servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty | SPDY header decoding continues inflating zlib-compressed header | blocks after the raw header parser has exceeded `maxHeaderSize` and | marked the frame truncated in `SpdyFrameCodec`, allowing a remote | peer to send a small compressed `HEADERS` block that expands into | much larger raw header data and causes compression-amplified CPU and | allocation churn. This issue is fixed in versions 4.1.136.Final and | 4.2.16.Final. CVE-2026-55851[3]: | Netty is a network application framework for development of protocol | servers and clients. In versions 4.2.0.Final up to (but not | including) 4.2.16.Final, and 4.1.0.Final up to (but not including) | 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` | module performs protocol version detection by reading the 13th byte | as a signed Java `byte` and widening it to `int` without masking; a | PROXY protocol v2 binary prefix followed by version byte `0xFF` | sign-extends to `-1`, collides with the decoder's need-more-data | sentinel, and causes `ByteToMessageDecoder` to accumulate inbound | bytes in an unbounded `cumulation` buffer until direct memory is | exhausted. This issue is fixed in versions 4.1.136.Final and | 4.2.16.Final. CVE-2026-56745[4]: | Netty is a network application framework for development of protocol | servers and clients. In versions 4.2.0.Final through 4.2.15.Final | and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler | in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when | processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` | and stores the partially constructed `FullHttpRequest` in | `messageMap`; when the remote peer sends `RST_STREAM` for that | stream or the accumulated content exceeds `maxContentLength`, the | decoder removes the entry but does not release the pooled `ByteBuf`, | causing native memory exhaustion. This issue is fixed in versions | 4.1.136.Final and 4.2.16.Final. CVE-2026-56746[5]: | Netty is a network application framework for development of protocol | servers and clients. Versions 4.2.0.Final through 4.2.15.Final and | 4.1.0.Final through 4.1.135.Final, are vulnerable to security | control bypass during the origin evaluation process. CorsHandler | provides a shortCircuit() configuration designed to reject | unauthorized cross-origin requests immediately, acting as a security | control before requests reach the application. However, due to a | logical operator error in the origin evaluation process, this | protection can be entirely bypassed. An attacker can bypass the | short-circuit mechanism by sending a request with an Origin: null | header. This failure forwards unauthorized requests to the backend | application, bypassing intended access controls. This issue is fixed | in versions 4.1.136.Final and 4.2.16.Final. CVE-2026-56816[6]: | Netty is a network application framework for development of protocol | servers and clients. Prior to 4.2.16.Final, Netty's | `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame | types up to the wire-specified payload length without limits; | `decodeFrame` trusts `payLoadLength`, allowing an attacker to open | multiple QUIC streams and send reserved frames with very large | payload lengths to cause memory exhaustion and denial of service. | This issue is fixed in version 4.2.16.Final. CVE-2026-56817[7]: | Netty is a network application framework for development of protocol | servers and clients. In versions 4.2.0.Final through 4.2.15.Final | and 4.1.0.Final through 4.1.135.Final, any caller that can deliver | bytes to a Netty channel pipeline containing `XmlDecoder` can send | XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` | instantiated with no security configuration, leaving DTD and entity | handling active depending on Aalto XML async parser behavior and | creating conditional XML external entity risk. This issue is fixed | in versions 4.1.136.Final and 4.2.16.Final. CVE-2026-56819[8]: | Netty is a network application framework for development of protocol | servers and clients. In versions 4.2.0.Final through 4.2.15.Final | and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer | can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in | applications that enable HTTP/2 content decompression via | `DelegatingDecompressorFrameListener`. When a `DATA` frame is | processed for a stream whose decompressor has already been closed, | `Http2Decompressor.decompress(...)` calls | `decompressor.writeInbound(data.retain())` and does not release the | retained buffer on the error path, eventually exhausting direct | memory and crashing the JVM. This issue is fixed in versions | 4.1.136.Final and 4.2.16.Final. CVE-2026-56820[9]: | Netty is a network application framework for development of protocol | servers and clients. In versions 4.2.0.Final through 4.2.15.Final | and prior to 4.1.135.Final, `OcspClient` does not validate that the | `CertificateID` in an OCSP response matches the requested | `CertificateID`, which can lead to replay attack. | `OcspClient.validateResponse` accepts a legitimately signed `GOOD` | status response for an unrelated certificate issued by the same CA, | allowing bypass of revocation checks for another certificate. This | issue is fixed in versions 4.1.136.Final and 4.2.16.Final. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-44891 https://www.cve.org/CVERecord?id=CVE-2026-44891 [1] https://security-tracker.debian.org/tracker/CVE-2026-55831 https://www.cve.org/CVERecord?id=CVE-2026-55831 [2] https://security-tracker.debian.org/tracker/CVE-2026-55833 https://www.cve.org/CVERecord?id=CVE-2026-55833 [3] https://security-tracker.debian.org/tracker/CVE-2026-55851 https://www.cve.org/CVERecord?id=CVE-2026-55851 [4] https://security-tracker.debian.org/tracker/CVE-2026-56745 https://www.cve.org/CVERecord?id=CVE-2026-56745 [5] https://security-tracker.debian.org/tracker/CVE-2026-56746 https://www.cve.org/CVERecord?id=CVE-2026-56746 [6] https://security-tracker.debian.org/tracker/CVE-2026-56816 https://www.cve.org/CVERecord?id=CVE-2026-56816 [7] https://security-tracker.debian.org/tracker/CVE-2026-56817 https://www.cve.org/CVERecord?id=CVE-2026-56817 [8] https://security-tracker.debian.org/tracker/CVE-2026-56819 https://www.cve.org/CVERecord?id=CVE-2026-56819 [9] https://security-tracker.debian.org/tracker/CVE-2026-56820 https://www.cve.org/CVERecord?id=CVE-2026-56820 Regards, Salvatore __ This is the maintainer address of Debian's Java team <https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use [email protected] for discussions and questions.
