Withdrawn: CLEANSTART-2026-GY63167 — Security fixes in thingsboard 4.3.1.3-r1

Withdrawn by the publisher.

Affected: CleanStart: thingsboard

Package thingsboard version 4.3.1.3-r1 fixes 82 vulnerabilities: ghsa-r29c-68gh-xp6x, ghsa-h6fc-48rj-7qqh, ghsa-5m62-pw8w-7w9f, ghsa-gx5v-xp9w-j4cg, ghsa-fv25-8xcx-gqjc...

CVE-2026-44890 — Netty has Unbounded Direct Memory Consumption in its RedisDecoder

Affected: netty, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat Data Grid 8.6.2, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9, Red Hat JBoss Enterprise Application Platform 8.1, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Single Sign-On 7

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Most recent entries from all

bdu:2026-15468

Withdrawn: CLEANSTART-2026-GY63167 — Security fixes in thingsboard 4.3.1.3-r1

CVE-2026-44890 — Netty has Unbounded Direct Memory Consumption in its RedisDecoder