Search

Find a vulnerability

Search criteria

    10 vulnerabilities found for Red Hat build of Quarkus 3.33.2 by Red Hat

    CVE-2026-42587 (GCVE-0-2026-42587)

    Vulnerability from nvd – Published: 2026-05-13 18:22 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-13 18:43 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    Assigner
    References
    URL Tags
    https://github.com/netty/netty/security/advisorie… x_refsource_CONFIRM
    https://access.redhat.com/security/cve/CVE-2026-42587 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2477220 issue-trackingx_refsource_REDHAT
    https://security.access.redhat.com/data/csaf/v2/v… x_sadp-csaf-vex
    https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:28010 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:41951 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:53806 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:50085 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:25123 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:23808 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:24502 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:34608 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    io.netty netty-codec-http Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    io.netty netty-codec-http2 Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: codec-http , < * (rpm)
    Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: codec-http , < * (rpm)
    Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8.6.2 Unaffected: codec-http , < * (rpm)
    Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: codec-http , < * (rpm)
    Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8.1 Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
    		Create a notification for this product.
    Red Hat Streams for Apache Kafka 2.9.4 Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:amq_streams:2.9::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI 2.25 Unaffected: 1783443816 , < * (rpm)
        cpe:/a:redhat:openshift_ai:2.25::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat Cryostat 4     cpe:/a:redhat:cryostat:4
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat AMQ Broker 7     cpe:/a:redhat:amq_broker:7
    		Create a notification for this product.
    Red Hat Red Hat AMQ Clients     cpe:/a:redhat:amq_clients:2023
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42587",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:43:31.138358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T15:52:26.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat Data Grid 8.6.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Streams for Apache Kafka 2.9.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783443816",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "bazel6",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-modelmesh-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "satellite:el8/candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T18:22:21.699Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:31.543Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42587"
          },
          {
            "name": "RHBZ#2477220",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41951"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50085"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34608"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34608: Streams for Apache Kafka 2.9.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:01:35.415Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T18:22:21.699Z",
            "value": "Made public."
          }
        ],
        "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        },
        {
          "product": "netty-codec-http",
          "vendor": "io.netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        },
        {
          "product": "netty-codec-http2",
          "vendor": "io.netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T18:22:21.699Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
        }
      ],
      "source": {
        "advisory": "GHSA-f6hv-jmp6-3vwv",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42587",
    "datePublished": "2026-05-13T18:22:21.699Z",
    "dateReserved": "2026-04-28T17:26:12.086Z",
    "dateUpdated": "2026-08-13T12:04:31.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-42584 (GCVE-0-2026-42584)

    Vulnerability from nvd – Published: 2026-05-13 18:10 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: HttpClientCodec response desynchronization
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    7.3 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-13 18:35 UTC
    CWE
    • CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
    Assigner
    References
    URL Tags
    https://github.com/netty/netty/security/advisorie… x_refsource_CONFIRM
    https://access.redhat.com/security/cve/CVE-2026-42584 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2477224 issue-trackingx_refsource_REDHAT
    https://security.access.redhat.com/data/csaf/v2/v… x_sadp-csaf-vex
    https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:28010 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:53806 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:25123 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:23808 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:24502 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    io.netty netty-codec-http Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI 2.25 Unaffected: 1783443816 , < * (rpm)
        cpe:/a:redhat:openshift_ai:2.25::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat AMQ Broker 7     cpe:/a:redhat:amq_broker:7
    		Create a notification for this product.
    Red Hat Red Hat AMQ Clients     cpe:/a:redhat:amq_clients:2023
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8     cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42584",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:35:01.642953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T18:35:05.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783443816",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel6",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-modelmesh-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "satellite:el8/candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T18:10:48.437Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-444",
                "description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:24.246Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42584"
          },
          {
            "name": "RHBZ#2477224",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:01:51.846Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T18:10:48.437Z",
            "value": "Made public."
          }
        ],
        "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        },
        {
          "product": "netty-codec-http",
          "vendor": "io.netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message\u2019s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T18:10:48.437Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
        }
      ],
      "source": {
        "advisory": "GHSA-57rv-r2g8-2cj3",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: HttpClientCodec response desynchronization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42584",
    "datePublished": "2026-05-13T18:10:48.437Z",
    "dateReserved": "2026-04-28T17:26:12.086Z",
    "dateUpdated": "2026-08-13T12:04:24.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-42581 (GCVE-0-2026-42581)

    Vulnerability from nvd – Published: 2026-05-13 17:54 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    5.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-13 18:42 UTC
    CWE
    • CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
    Assigner
    References
    URL Tags
    https://github.com/netty/netty/security/advisorie… x_refsource_CONFIRM
    https://access.redhat.com/security/cve/CVE-2026-42581 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2477232 issue-trackingx_refsource_REDHAT
    https://security.access.redhat.com/data/csaf/v2/v… x_sadp-csaf-vex
    https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:28010 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:53806 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:25123 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:23808 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:24502 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI 2.25 Unaffected: 1783443816 , < * (rpm)
        cpe:/a:redhat:openshift_ai:2.25::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat AMQ Broker 7     cpe:/a:redhat:amq_broker:7
    		Create a notification for this product.
    Red Hat Red Hat AMQ Clients     cpe:/a:redhat:amq_clients:2023
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8     cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42581",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:42:38.397208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T18:42:59.711Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783443816",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel6",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-modelmesh-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "satellite:el8/candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T17:54:44.492Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-444",
                "description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:30.558Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42581"
          },
          {
            "name": "RHBZ#2477232",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42581.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:02:26.404Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T17:54:44.492Z",
            "value": "Made public."
          }
        ],
        "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T17:54:44.492Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
        }
      ],
      "source": {
        "advisory": "GHSA-xxqh-mfjm-7mv9",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42581",
    "datePublished": "2026-05-13T17:54:44.492Z",
    "dateReserved": "2026-04-28T17:26:12.085Z",
    "dateUpdated": "2026-08-13T12:04:30.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-42579 (GCVE-0-2026-42579)

    Vulnerability from nvd – Published: 2026-05-13 18:01 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-18 15:39 UTC
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-626 - Null Byte Interaction Error (Poison Null Byte)
    • CWE-1286 - Improper Validation of Syntactic Correctness of Input
    Assigner
    References
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: codec-dns , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: codec-dns , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: codec-dns , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8     cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42579",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-18T15:39:59.449891Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-18T15:40:22.534Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-dns",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-dns",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-dns",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-dns",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T18:01:52.500Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1286",
                "description": "Improper Validation of Syntactic Correctness of Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:22.860Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42579"
          },
          {
            "name": "RHBZ#2477217",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42579.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:01:25.062Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T18:01:52.500Z",
            "value": "Made public."
          }
        ],
        "title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-626",
              "description": "CWE-626: Null Byte Interaction Error (Poison Null Byte)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T18:01:52.500Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
        }
      ],
      "source": {
        "advisory": "GHSA-cm33-6792-r9fm",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42579",
    "datePublished": "2026-05-13T18:01:52.500Z",
    "dateReserved": "2026-04-28T17:26:12.085Z",
    "dateUpdated": "2026-08-13T12:04:22.860Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-42578 (GCVE-0-2026-42578)

    Vulnerability from nvd – Published: 2026-05-13 17:57 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    2.9 (Low)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-13 18:36 UTC
    CWE
    • CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
    • CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
    Assigner
    References
    URL Tags
    https://github.com/netty/netty/security/advisorie… x_refsource_CONFIRM
    https://access.redhat.com/security/cve/CVE-2026-42578 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2477226 issue-trackingx_refsource_REDHAT
    https://security.access.redhat.com/data/csaf/v2/v… x_sadp-csaf-vex
    https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:28010 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:53806 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:25123 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:23808 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:24502 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: handler-proxy , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: handler-proxy , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: handler-proxy , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI 2.25 Unaffected: 1783443816 , < * (rpm)
        cpe:/a:redhat:openshift_ai:2.25::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat AMQ Broker 7     cpe:/a:redhat:amq_broker:7
    		Create a notification for this product.
    Red Hat Red Hat AMQ Clients     cpe:/a:redhat:amq_clients:2023
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8     cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42578",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:36:58.234828Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T15:52:12.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "handler-proxy",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "handler-proxy",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "handler-proxy",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783443816",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel6",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-modelmesh-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "satellite:el8/candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-handler-proxy",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T17:57:43.538Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-93",
                "description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:34.173Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42578"
          },
          {
            "name": "RHBZ#2477226",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42578.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:02:00.826Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T17:57:43.538Z",
            "value": "Made public."
          }
        ],
        "title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
        "workarounds": [
          {
            "lang": "en",
            "value": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T17:57:43.538Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
        }
      ],
      "source": {
        "advisory": "GHSA-45q3-82m4-75jr",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42578",
    "datePublished": "2026-05-13T17:57:43.538Z",
    "dateReserved": "2026-04-28T17:26:12.085Z",
    "dateUpdated": "2026-08-13T12:04:34.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-42587 (GCVE-0-2026-42587)

    Vulnerability from cvelistv5 – Published: 2026-05-13 18:22 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-13 18:43 UTC
    CWE
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-770 - Allocation of Resources Without Limits or Throttling
    Assigner
    References
    URL Tags
    https://github.com/netty/netty/security/advisorie… x_refsource_CONFIRM
    https://access.redhat.com/security/cve/CVE-2026-42587 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2477220 issue-trackingx_refsource_REDHAT
    https://security.access.redhat.com/data/csaf/v2/v… x_sadp-csaf-vex
    https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:28010 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:41951 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:53806 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:50085 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:25123 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:23808 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:24502 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:34608 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    io.netty netty-codec-http Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    io.netty netty-codec-http2 Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: codec-http , < * (rpm)
    Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: codec-http , < * (rpm)
    Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8.6.2 Unaffected: codec-http , < * (rpm)
    Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: codec-http , < * (rpm)
    Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8.1 Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
    		Create a notification for this product.
    Red Hat Streams for Apache Kafka 2.9.4 Unaffected: codec-http2 , < * (rpm)
        cpe:/a:redhat:amq_streams:2.9::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI 2.25 Unaffected: 1783443816 , < * (rpm)
        cpe:/a:redhat:openshift_ai:2.25::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat Cryostat 4     cpe:/a:redhat:cryostat:4
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat AMQ Broker 7     cpe:/a:redhat:amq_broker:7
    		Create a notification for this product.
    Red Hat Red Hat AMQ Clients     cpe:/a:redhat:amq_clients:2023
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42587",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:43:31.138358Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T15:52:26.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat Data Grid 8.6.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              },
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Streams for Apache Kafka 2.9.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783443816",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "bazel6",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-modelmesh-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "satellite:el8/candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http2",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T18:22:21.699Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:31.543Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42587"
          },
          {
            "name": "RHBZ#2477220",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41951"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50085"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34608"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34608: Streams for Apache Kafka 2.9.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:01:35.415Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T18:22:21.699Z",
            "value": "Made public."
          }
        ],
        "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        },
        {
          "product": "netty-codec-http",
          "vendor": "io.netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        },
        {
          "product": "netty-codec-http2",
          "vendor": "io.netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T18:22:21.699Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
        }
      ],
      "source": {
        "advisory": "GHSA-f6hv-jmp6-3vwv",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42587",
    "datePublished": "2026-05-13T18:22:21.699Z",
    "dateReserved": "2026-04-28T17:26:12.086Z",
    "dateUpdated": "2026-08-13T12:04:31.543Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-42584 (GCVE-0-2026-42584)

    Vulnerability from cvelistv5 – Published: 2026-05-13 18:10 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: HttpClientCodec response desynchronization
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    7.3 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-13 18:35 UTC
    CWE
    • CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
    Assigner
    References
    URL Tags
    https://github.com/netty/netty/security/advisorie… x_refsource_CONFIRM
    https://access.redhat.com/security/cve/CVE-2026-42584 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2477224 issue-trackingx_refsource_REDHAT
    https://security.access.redhat.com/data/csaf/v2/v… x_sadp-csaf-vex
    https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:28010 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:53806 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:25123 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:23808 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:24502 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    io.netty netty-codec-http Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI 2.25 Unaffected: 1783443816 , < * (rpm)
        cpe:/a:redhat:openshift_ai:2.25::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat AMQ Broker 7     cpe:/a:redhat:amq_broker:7
    		Create a notification for this product.
    Red Hat Red Hat AMQ Clients     cpe:/a:redhat:amq_clients:2023
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8     cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42584",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:35:01.642953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T18:35:05.734Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783443816",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel6",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-modelmesh-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "satellite:el8/candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T18:10:48.437Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-444",
                "description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:24.246Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42584"
          },
          {
            "name": "RHBZ#2477224",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:01:51.846Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T18:10:48.437Z",
            "value": "Made public."
          }
        ],
        "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        },
        {
          "product": "netty-codec-http",
          "vendor": "io.netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message\u2019s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T18:10:48.437Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
        }
      ],
      "source": {
        "advisory": "GHSA-57rv-r2g8-2cj3",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: HttpClientCodec response desynchronization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42584",
    "datePublished": "2026-05-13T18:10:48.437Z",
    "dateReserved": "2026-04-28T17:26:12.086Z",
    "dateUpdated": "2026-08-13T12:04:24.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-42579 (GCVE-0-2026-42579)

    Vulnerability from cvelistv5 – Published: 2026-05-13 18:01 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-18 15:39 UTC
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-400 - Uncontrolled Resource Consumption
    • CWE-626 - Null Byte Interaction Error (Poison Null Byte)
    • CWE-1286 - Improper Validation of Syntactic Correctness of Input
    Assigner
    References
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: codec-dns , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: codec-dns , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: codec-dns , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8     cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42579",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-18T15:39:59.449891Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-18T15:40:22.534Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-dns",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-dns",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-dns",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-dns",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-dns",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T18:01:52.500Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-1286",
                "description": "Improper Validation of Syntactic Correctness of Input",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:22.860Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42579"
          },
          {
            "name": "RHBZ#2477217",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42579.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:01:25.062Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T18:01:52.500Z",
            "value": "Made public."
          }
        ],
        "title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-626",
              "description": "CWE-626: Null Byte Interaction Error (Poison Null Byte)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T18:01:52.500Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
        }
      ],
      "source": {
        "advisory": "GHSA-cm33-6792-r9fm",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42579",
    "datePublished": "2026-05-13T18:01:52.500Z",
    "dateReserved": "2026-04-28T17:26:12.085Z",
    "dateUpdated": "2026-08-13T12:04:22.860Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-42578 (GCVE-0-2026-42578)

    Vulnerability from cvelistv5 – Published: 2026-05-13 17:57 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    2.9 (Low)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-13 18:36 UTC
    CWE
    • CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
    • CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
    Assigner
    References
    URL Tags
    https://github.com/netty/netty/security/advisorie… x_refsource_CONFIRM
    https://access.redhat.com/security/cve/CVE-2026-42578 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2477226 issue-trackingx_refsource_REDHAT
    https://security.access.redhat.com/data/csaf/v2/v… x_sadp-csaf-vex
    https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:28010 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:53806 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:25123 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:23808 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:24502 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: handler-proxy , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: handler-proxy , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: handler-proxy , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI 2.25 Unaffected: 1783443816 , < * (rpm)
        cpe:/a:redhat:openshift_ai:2.25::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat AMQ Broker 7     cpe:/a:redhat:amq_broker:7
    		Create a notification for this product.
    Red Hat Red Hat AMQ Clients     cpe:/a:redhat:amq_clients:2023
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8     cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42578",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:36:58.234828Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T15:52:12.304Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "handler-proxy",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "handler-proxy",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "handler-proxy",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783443816",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "affected",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel6",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "affected",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-modelmesh-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unaffected",
            "packageName": "satellite:el8/candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-handler-proxy",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-handler-proxy",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T17:57:43.538Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-93",
                "description": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:34.173Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42578"
          },
          {
            "name": "RHBZ#2477226",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42578.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:02:00.826Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T17:57:43.538Z",
            "value": "Made public."
          }
        ],
        "title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
        "workarounds": [
          {
            "lang": "en",
            "value": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.9,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T17:57:43.538Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
        }
      ],
      "source": {
        "advisory": "GHSA-45q3-82m4-75jr",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42578",
    "datePublished": "2026-05-13T17:57:43.538Z",
    "dateReserved": "2026-04-28T17:26:12.085Z",
    "dateUpdated": "2026-08-13T12:04:34.173Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-42581 (GCVE-0-2026-42581)

    Vulnerability from cvelistv5 – Published: 2026-05-13 17:54 – Updated: 2026-08-13 12:04
    VLAI
    Title
    Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
    Summary
    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
    Severity
    5.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
    7.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: poc Automatable: yes Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-05-13 18:42 UTC
    CWE
    • CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
    Assigner
    References
    URL Tags
    https://github.com/netty/netty/security/advisorie… x_refsource_CONFIRM
    https://access.redhat.com/security/cve/CVE-2026-42581 vdb-entryx_refsource_REDHAT
    https://bugzilla.redhat.com/show_bug.cgi?id=2477232 issue-trackingx_refsource_REDHAT
    https://security.access.redhat.com/data/csaf/v2/v… x_sadp-csaf-vex
    https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:28010 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:53806 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:25123 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:23808 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:24502 vendor-advisoryx_refsource_REDHAT
    https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
    Impacted products
    Vendor Product Version
    netty netty Affected: >= 4.2.0.Alpha1, < 4.2.13.Final
    Affected: < 4.1.133.Final
    		Create a notification for this product.
    Red Hat Cryostat 4 on RHEL 9 Unaffected: 4.2.0-10 , < * (rpm)
        cpe:/a:redhat:cryostat:4::el9
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:apache_camel_spring_boot:4.18
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.27.4 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:quarkus:3.27::el8
    		Create a notification for this product.
    Red Hat Red Hat build of Quarkus 3.33.2     cpe:/a:redhat:quarkus:3.33::el8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4.25 Unaffected: codec-http , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.16.0-22.redhat_00057.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.3.14-11.SP11_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.5.26-2.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.18.8-1.redhat_00003.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:5.0.31-3.SP2_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:1.10.0-46.Final_redhat_00044.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:4.1.135-1.Final_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-30.SP12_redhat_00020.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.5.5-24.SP12_redhat_00016.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:2.2.40-2.SP3_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 Unaffected: 0:7.4.25-2.GA_redhat_00001.1.el7eap , < * (rpm)
        cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI 2.25 Unaffected: 1783443816 , < * (rpm)
        cpe:/a:redhat:openshift_ai:2.25::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780948325 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780696380 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.28 Unaffected: 1780694994 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.28::el9
    		Create a notification for this product.
    Red Hat Red Hat OpenShift Dev Spaces 3.29 Unaffected: 1782989027 , < * (rpm)
        cpe:/a:redhat:openshift_devspaces:3.29::el9
    		Create a notification for this product.
    Red Hat OpenShift Serverless     cpe:/a:redhat:serverless:1
    		Create a notification for this product.
    Red Hat Red Hat AMQ Broker 7     cpe:/a:redhat:amq_broker:7
    		Create a notification for this product.
    Red Hat Red Hat AMQ Clients     cpe:/a:redhat:amq_clients:2023
    		Create a notification for this product.
    Red Hat Red Hat build of Apache Camel 4 for Quarkus 3     cpe:/a:redhat:camel_quarkus:3
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 2     cpe:/a:redhat:service_registry:2
    		Create a notification for this product.
    Red Hat Red Hat build of Apicurio Registry 3     cpe:/a:redhat:apicurio_registry:3
    		Create a notification for this product.
    Red Hat Red Hat build of Debezium 3     cpe:/a:redhat:debezium:3
    		Create a notification for this product.
    Red Hat Red Hat Build of Keycloak     cpe:/a:redhat:build_keycloak:
    		Create a notification for this product.
    Red Hat Red Hat build of OptaPlanner 8     cpe:/a:redhat:optaplanner:::el6
    		Create a notification for this product.
    Red Hat Red Hat Data Grid 8     cpe:/a:redhat:jboss_data_grid:8
    		Create a notification for this product.
    Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3     cpe:/a:redhat:enterprise_linux_ai:3
    		Create a notification for this product.
    Red Hat Red Hat Fuse 7     cpe:/a:redhat:jboss_fuse:7
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform 8     cpe:/a:redhat:jboss_enterprise_application_platform:8
    		Create a notification for this product.
    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack     cpe:/a:redhat:jbosseapxp
    		Create a notification for this product.
    Red Hat Red Hat OpenShift AI (RHOAI)     cpe:/a:redhat:openshift_ai
    		Create a notification for this product.
    Red Hat Red Hat Process Automation 7     cpe:/a:redhat:jboss_enterprise_bpms_platform:7
    		Create a notification for this product.
    Red Hat Red Hat Satellite 6     cpe:/a:redhat:satellite:6
    		Create a notification for this product.
    Red Hat Red Hat Single Sign-On 7     cpe:/a:redhat:red_hat_single_sign_on:7
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 2     cpe:/a:redhat:amq_streams:2
    		Create a notification for this product.
    Red Hat streams for Apache Kafka 3     cpe:/a:redhat:amq_streams:3
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42581",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-13T18:42:38.397208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-13T18:42:59.711Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-reports-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/jfr-datasource-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.27::el8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Quarkus 3.27.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:quarkus:3.33::el8"
            ],
            "defaultStatus": "unaffected",
            "product": "Red Hat build of Quarkus 3.33.2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-http",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-activemq-artemis",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.16.0-22.redhat_00057.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-glassfish-jsf",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-ironjacamar",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-annotations",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-core",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-databind",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-jaxrs-providers",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-base",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jackson-modules-java8",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.18.8-1.redhat_00003.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-remoting",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-jboss-server-migration",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-netty-transport-native-epoll",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-bindings",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-picketlink-federation",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-undertow",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
            ],
            "defaultStatus": "affected",
            "packageName": "eap7-wildfly",
            "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-modelmesh-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783443816",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780948325",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780696380",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.28::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/server-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.28",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1780694994",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/multicluster-redirector-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989027",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:serverless:1"
            ],
            "defaultStatus": "unknown",
            "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
            "product": "OpenShift Serverless",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Broker 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_clients:2023"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat AMQ Clients",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:camel_quarkus:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apache Camel 4 for Quarkus 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:service_registry:2"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apicurio_registry:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Apicurio Registry 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:debezium:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of Debezium 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk/keycloak-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk/keycloak-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:build_keycloak:"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
            "product": "Red Hat Build of Keycloak",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:optaplanner:::el6"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat build of OptaPlanner 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Data Grid 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel6",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel7",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux_ai:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "bazel8",
            "product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-modelmesh-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-spark-operator-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-trustyai-service-rhel8",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unknown",
            "packageName": "rhoai/odh-trustyai-service-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Process Automation 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:satellite:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "satellite:el8/candlepin",
            "product": "Red Hat Satellite 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:2"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_streams:3"
            ],
            "defaultStatus": "unknown",
            "packageName": "netty-codec-http",
            "product": "streams for Apache Kafka 3",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-13T17:54:44.492Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-444",
                "description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T12:04:30.558Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-42581"
          },
          {
            "name": "RHBZ#2477232",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42581.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28010"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:53806"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42644"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:25123"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:23808"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:24502"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54435"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-13T19:02:26.404Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-13T17:54:44.492Z",
            "value": "Made public."
          }
        ],
        "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.133.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-13T17:54:44.492Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
        }
      ],
      "source": {
        "advisory": "GHSA-xxqh-mfjm-7mv9",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42581",
    "datePublished": "2026-05-13T17:54:44.492Z",
    "dateReserved": "2026-04-28T17:26:12.085Z",
    "dateUpdated": "2026-08-13T12:04:30.558Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}