Количество 8
Количество 8
GHSA-57rv-r2g8-2cj3
Netty has HttpClientCodec response desynchronization
CVE-2026-42584
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVE-2026-42584
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVE-2026-42584
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVE-2026-42584
Netty is an asynchronous, event-driven network application framework. ...
ROS-20260624-73-0026
Уязвимость netty
BDU:2026-09804
Уязвимость компонента HttpClientCodec фреймворка для разработки сетевых приложений, серверов и клиентов протоколов Netty, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации
SUSE-SU-2026:2308-1
Security update for netty, netty-tcnative
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| GHSA-57rv-r2g8-2cj3 Netty has HttpClientCodec response desynchronization | CVSS3: 7.3 | 1% Низкий | 3 месяца назад |
 | CVE-2026-42584 Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final. | CVSS3: 7.3 | 1% Низкий | 3 месяца назад |
 | CVE-2026-42584 Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final. | CVSS3: 7.3 | 1% Низкий | 3 месяца назад |
 | CVE-2026-42584 Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final. | CVSS3: 7.3 | 1% Низкий | 3 месяца назад |
| CVE-2026-42584 Netty is an asynchronous, event-driven network application framework. ... | CVSS3: 7.3 | 1% Низкий | 3 месяца назад |
 | ROS-20260624-73-0026 Уязвимость netty | CVSS3: 9.1 | 1% Низкий | около 1 месяца назад |
 | BDU:2026-09804 Уязвимость компонента HttpClientCodec фреймворка для разработки сетевых приложений, серверов и клиентов протоколов Netty, позволяющая нарушителю оказать воздействие на целостность и доступность защищаемой информации | CVSS3: 9.1 | 1% Низкий | 3 месяца назад |
 | SUSE-SU-2026:2308-1 Security update for netty, netty-tcnative | около 2 месяцев назад |
Уязвимостей на страницу