Threats Tagged 'cve-2026-47691'

A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Security Fix(es): * memory exhaustion in io.netty:netty-codec-haproxy (CVE-2026-48059) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-47691) * DDoS in io.netty:netty-codec-http2 (CVE-2026-50560) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-50011) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44250) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44890) * IPv6 subnet filter bypass in io.netty:netty-handler (CVE-2026-44249) * request smuggling in io.netty:netty-codec-http (CVE-2026-50020) * memory leak in io.netty:netty-codec-haproxy (CVE-2026-44893) * TLS hostname verification accidentally disabled in io.netty:netty-handler (CVE-2026-50010) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45673) * excessive memory usage from SNIHandler in io.netty:netty-handler (CVE-2026-45416) * file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue (CVE-2026-45536) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45674) * memory exhaustion in io.netty:netty-transport-sctp (CVE-2026-46340) * denial of service in io.netty:netty-codec-http2 (CVE-2026-47244) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-48006) * memory exhaustion in io.netty:netty-codec-http2 (CVE-2026-48043) * netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is an update for Red Hat JBoss Enterprise Application Platform 8.1. See Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674) * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

### Summary Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). ### Details In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. This means if the resolver queries evil.co.uk., it will accept an NS record claiming authority over co.uk.. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key (co.uk.). This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under co.uk.. The `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#cache` method only prevents caching if the record is for the root zone (dots == 1). ### Impact DNS Cache Poisoning. Any application using Netty's DNS resolver is impacted.

Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot patch release and security update is now available. The purpose of this text-only errata is to inform you about the security issues fixed. Security Fix(es): * cxf-services-xkms-x509-repo-ldap: Apache CXF: Information Disclosure via LDAP Injection (CVE-2026-44930) * cxf-rt-transports-jms: Apache CXF: Arbitrary code execution via untrusted JMS configuration (CVE-2026-50632) * cxf-rt-rs-security-oauth2-saml: Apache CXF: Token Confusion/Routing attacks due to improper validation of JWT audience claims (CVE-2026-50627) * cxf-rt-rs-security-oauth2: Apache CXF: Token Confusion/Routing attacks due to improper validation of JWT audience claims (CVE-2026-50627) * cxf-rt-rs-security-oauth2-saml: cxf: Unauthorized access due to logic error in OAuthRequestFilter (CVE-2026-50628) * cxf-rt-rs-security-oauth2: cxf: Unauthorized access due to logic error in OAuthRequestFilter (CVE-2026-50628) * cxf-integration-jca: Apache CXF: Arbitrary code execution via JNDI Injection (CVE-2026-50633) * cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening (CVE-2026-49875) * netty-codec-redis: Netty: Denial of Service via malicious Redis array header (CVE-2026-50011) * netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays (CVE-2026-44250) * netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads (CVE-2026-44890) * netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments (CVE-2026-46340) * netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass (CVE-2026-50010) * netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVE-2026-48006) * netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691) * netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059) * netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043) * netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893) * netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249) * assertj-core: AssertJ: Information disclosure and denial of service via XML External Entity (XXE) (CVE-2026-24400) * cxf-rt-transports-jms: Apache CXF: Remote Code Execution via untrusted JMS configuration (CVE-2026-44417) * netty-codec-mqtt: Netty: Denial of Service due to excessive resource consumption from crafted MQTT 5 header (CVE-2026-44248) * netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) * netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578) * netty-codec-redis: Netty: Command injection via CRLF characters in Redis codec encoder (CVE-2026-42586) * netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581) * netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584) * netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579) * log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames (CVE-2026-34478) * log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging (CVE-2026-34480) * log4j-layout-template-json: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output (CVE-2026-34481) * micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests (CVE-2026-40984) * netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416) * netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)