CVE-2026-93562 is a vulnerability in Netty's HTTP/1 decoder used by Red Hat AMQ Broker 7. It involves incomplete validation of malformed Transfer-Encoding headers, enabling remote attackers to perform HTTP request smuggling. This can allow injection of arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources. The vulnerability has a CVSS score of 6.5 (medium severity).
CVE-2026-93579 is a medium severity vulnerability in Netty's HTTP/2 stack used by Red Hat Build of Debezium 3.6. It allows remote attackers to inject prohibited characters such as NUL, Line Feed, and Carriage Return into HTTP/2 header field values due to insufficient validation. This can lead to HTTP request smuggling, header injection, or response splitting when crossing HTTP/2 to HTTP/1.1 translation boundaries, potentially causing unauthorized access or data manipulation. A security update addressing this issue is available in Red Hat build of Quarkus 3.27.5.SP2. Users are advised to apply this update to mitigate the vulnerability.
CVE-2026-93566 is a medium severity vulnerability in the Netty HTTP codec used by Red Hat Build of Debezium 3.6. It allows a remote attacker to bypass strict validation by sending a specially crafted HTTP request containing control characters in the chunk-size line, leading to HTTP request smuggling. This can result in information disclosure or unauthorized actions. Red Hat has published an advisory indicating that this issue is addressed in Red Hat build of Quarkus 3.27.5.SP2 with a security update. Users are advised to apply this update to mitigate the vulnerability.
CVE-2026-93565 is a high-severity vulnerability in the Netty RtspDecoder component used by Red Hat Build of Apache Camel 3.33.3.SP2. The flaw involves improper handling in the RtspMethods.valueOf() function, which incorrectly strips trailing control bytes from RTSP method tokens. This can be exploited remotely by sending crafted RTSP requests to bypass method-based access controls and to smuggle malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
CVE-2026-93564 is a high-severity vulnerability in the Netty component used by Red Hat Build of Apache Camel 3.33.3.SP2. It involves a reference-count leak in the HAProxy PROXY-v2 message decoder that allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This flaw can cause memory exhaustion leading to a denial of service (DoS) condition. Red Hat has issued an advisory referencing this issue as part of a broader security update for Red Hat build of Quarkus 3.27.5.SP2. The advisory indicates that a security update is available to address this and other vulnerabilities.
CVE-2026-93558 is a high-severity denial of service vulnerability in Netty's WebSocketServerExtensionHandler used by Red Hat Build of Apache Camel 3.33.3.SP2. An unauthenticated remote attacker can exploit HTTP/1.1 pipelining to cause unbounded growth of a per-connection queue, exhausting JVM heap memory and causing service disruption. Red Hat has issued an important security advisory addressing this issue in the Red Hat build of Quarkus 3.27.5.SP2, which includes the fix for this vulnerability.
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.
CVE-2026-93492 is a medium severity vulnerability in the Netty HTTP/2 HpackEncoder component used by Red Hat Build of Debezium 3.6. It allows a remote attacker to cause a denial of service by sending HTTP/2 SETTINGS frames with an excessively large MAX_HEADER_TABLE_SIZE, leading to high CPU and memory usage. Red Hat has published an advisory referencing this issue as part of a broader security update for Red Hat build of Quarkus 3.27.5.SP2. The advisory indicates that a security update is available to address this and other vulnerabilities.
A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash.
A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.
A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments.
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.