Описание
Security update for netty, netty-tcnative
This update for netty, netty-tcnative fixes the following issues:
Upgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.
Security issues fixed
- CVE-2026-44891: memory exhaustion in
io.netty:netty-codec-stomp(bsc#1271435). - CVE-2026-55831: resource exhaustion/DoS in
io.netty:netty-codec-http(bsc#1271960). - CVE-2026-55833: zip bomb in
io.netty:netty-codec-http(bsc#1271961). - CVE-2026-55851: memory exhaustion in
io.netty:netty-codec-haproxy(bsc#1272253). - CVE-2026-56745: memory exhaustion in
io.netty:netty-codec-http(bsc#1272254). - CVE-2026-56746: improper access control in
io.netty:netty-codec-http(CORS) (bsc#1272255). - CVE-2026-56817: insecure defaults in XML parsing in
io.netty:netty-codec-xml(bsc#1272257). - CVE-2026-56818: memory leak in
io.netty:netty-codec-redis(bsc#1272603). - CVE-2026-56819: memory leak in
io.netty:netty-codec-http2(bsc#1272258). - CVE-2026-56820: improper certificate validation in
io.netty:netty-handler-ssl-ocsp(bsc#1272259). - CVE-2026-56821: improper certificate revocation check in
io.netty:netty-handler-ssl-ocsp(bsc#1272299). - CVE-2026-56822: time-of-check/time-of-use in
io.netty:netty-handler-ssl-ocsp(bsc#1272300). - CVE-2026-59898: protocol version confusion in
io.netty:netty-codec-http(websocket) (bsc#1272302). - CVE-2026-59899: memory exhaustion in
io.netty:netty-codec-http(bsc#1272301). - CVE-2026-59900: improper header neutralization in
io.netty:netty-codec-http2(bsc#1272303). - CVE-2026-59901: infinite loop in
io.netty:netty-codec-compression(bzip2) (bsc#1272304). - CVE-2026-59919: improper CR/LF neutralization in
io.netty:netty-codec-haproxy(bsc#1272305). - CVE-2026-59920: improper CR/LF neutrolization in
io.netty:netty-codec-stomp(bsc#1272306). - CVE-2026-59921: improper CR/LF neutralization in
io.netty:netty-codec-http(multipart) (bsc#1272307). - Memory leak in
io.netty:netty-codec-dns(bsc#1272519). - Uncontrolled resource consumption in
io.netty:netty-codec-xml(bsc#1272518).
Other updates and bugfixes:
- Upgrade to upstream version 4.1.136:
- SingleThreadEventExecutor: document Throwable safety contract on run()
- Make HTTP/2 frame hashCode consistent with equals
- Add BlockHound exception for DnsQueryIdSpace (#16896)
- FlowControlHandler: Fix autoRead behavior
- Fix incorrect bounds in error message of HpackDecoder.setMaxHeaderListSize
- MQTT: Fix MQTT decoder size check after variable header replay
- MQTT: Make the decodeProperties early-REPLAY check actually fire
- Reject control characters at the boundary of HTTP method names (#16723)
- Update to latest tcnative release
- Fix HTTP 2 PUSH_PROMISE stream association validation
- Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder
- Add opt-in validation of mandatory pseudo-header fields for HTTP/2
- Strictly validate MQTT UTF-8 Encoded String (#16939)
- Stop DateFormatter trailing token from running past the parse end
- IpFilter: Deprecate constructor which use accept by default
- Add RFC 10008 QUERY Method support (#16966)
- Correctly release and fail queued traffic-shaping writes on close (#16959)
- FlowControlHandler: respect auto-read when toggled while dequeueing
- IdleStateHandler: reset firstWriter/ReaderIdleEvent in resetWriteTimeout/resetReadTimeout (#16982)
- Fix typo in AbstractSniHandler Javadoc
- Reconcile AbstractCoalescingBufferQueue readableBytes when it drains, and fail stuck HTTP/2 streams instead of spinning empty DATA frames
- Reject control characters at the boundary of the HTTP version token (#16971)
- Reset UTF-8 decode state on CR in StompSubframeDecoder
- HTTP2: Pass the correct number of arguments when logging goaway
- FastLz: Guard decompression against truncated input (#17000)
- Fix propagation of startTls for client SslContext handler
- Reject non-token characters in HTTP/2 header names
- Update lz4-java to 1.11.1
- Pin github actions to reduce risk (#17043)
- Merge branches from forks (#17063)
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Module for Development Tools 15 SP7
SUSE Linux Enterprise Module for Package Hub 15 SP7
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
SUSE Linux Enterprise Server for SAP Applications 15 SP6
Ссылки
- Link for SUSE-SU-2026:3482-1
- E-Mail link for SUSE-SU-2026:3482-1
- SUSE Security Ratings
- SUSE Bug 1271435
- SUSE Bug 1271960
- SUSE Bug 1271961
- SUSE Bug 1272253
- SUSE Bug 1272254
- SUSE Bug 1272255
- SUSE Bug 1272257
- SUSE Bug 1272258
- SUSE Bug 1272259
- SUSE Bug 1272299
- SUSE Bug 1272300
- SUSE Bug 1272301
- SUSE Bug 1272302
- SUSE Bug 1272303
- SUSE Bug 1272304
- SUSE Bug 1272305
- SUSE Bug 1272306
Описание
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-44891
- SUSE Bug 1271435
Описание
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-55831
- SUSE Bug 1271960
Описание
Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-55833
- SUSE Bug 1271961
Описание
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-55851
- SUSE Bug 1272253
Описание
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-56745
- SUSE Bug 1272254
Описание
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-56746
- SUSE Bug 1272255
Описание
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-56817
- SUSE Bug 1272257
Описание
unknown
Затронутые продукты
Ссылки
- CVE-2026-56818
- SUSE Bug 1272603
Описание
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-56819
- SUSE Bug 1272258
Описание
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-56820
- SUSE Bug 1272259
Описание
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-56821
- SUSE Bug 1272299
Описание
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by the OCSP check. n io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered, when an SslHandshakeCompletionEvent is received, the validator immediately calls ctx.fireUserEventTriggered(evt). It then initiates an asynchronous OCSP query using OcspClient.query. Because the handshake completion event is forwarded immediately, downstream handlers in the client's pipeline are notified that the TLS handshake is successful. They may then begin reading and processing incoming application data or sending outgoing data. If the OCSP response later indicates the server's certificate is REVOKED, the validator closes the channel, but by this time, the client may have already leaked sensitive data to a revoked server or processed malicious responses from it. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-56822
- SUSE Bug 1272300
Описание
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-59898
- SUSE Bug 1272302
Описание
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-59899
- SUSE Bug 1272301
Описание
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-59900
- SUSE Bug 1272303
Описание
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within [`Bzip2BlockDecompressor.read()`]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-59901
- SUSE Bug 1272304
Описание
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \r\n sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-59919
- SUSE Bug 1272305
Описание
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional STOMP headers. This happens because the encoder intentionally skips escaping for CONNECT/CONNECTED frames per the STOMP 1.2 specification but never rejects the raw newlines, and since a broker parses each line as a separate header, an attacker controlling a value such as a user-supplied login or passcode can overwrite connection parameters or add authentication/role headers to bypass authentication or escalate privileges (the actual impact is broker-dependent). The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-59920
- SUSE Bug 1272306
Описание
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Затронутые продукты
Ссылки
- CVE-2026-59921
- SUSE Bug 1272307