Vulnerability-Lookup

CVE-2026-44250 (GCVE-0-2026-44250)

Vulnerability from cvelistv5 – Published: 2026-06-11 20:49 – Updated: 2026-08-05 12:15

Title

Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays

Summary

Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

9 references

URL	Tags
https://github.com/netty/netty/security/advisorie…	x_refsource_CONFIRM
https://github.com/netty/netty/releases/tag/netty…	x_refsource_MISC
https://github.com/netty/netty/releases/tag/netty…	x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2026-44250	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2488062	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:41951	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50085	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:37390	vendor-advisoryx_refsource_REDHAT

Impacted products

8 products

Vendor	Product	Version
netty	netty	Affected: >= 4.2.0.Final, < 4.2.15.Final Affected: < 4.1.135.Final
Red Hat	Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16	Unaffected: codec-redis , < * (rpm) cpe:/a:redhat:apache_camel_spring_boot:4.18
Red Hat	Red Hat Data Grid 8.6.2	Unaffected: codec-redis , < * (rpm) cpe:/a:redhat:jboss_data_grid:8
Red Hat	Red Hat JBoss Enterprise Application Platform 8.1	Unaffected: codec-redis , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9
Red Hat	Red Hat Fuse 7	cpe:/a:redhat:jboss_fuse:7
Red Hat	Red Hat JBoss Enterprise Application Platform 7	cpe:/a:redhat:jboss_enterprise_application_platform:7
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	cpe:/a:redhat:jbosseapxp
Red Hat	Red Hat Single Sign-On 7	cpe:/a:redhat:red_hat_single_sign_on:7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44250",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-12T13:44:38.298945Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-12T13:44:45.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:apache_camel_spring_boot:4.18"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-redis",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_data_grid:8"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat Data Grid 8.6.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-redis",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "netty",
            "product": "Red Hat JBoss Enterprise Application Platform 8.1",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "codec-redis",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_fuse:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-redis",
            "product": "Red Hat Fuse 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jboss_enterprise_application_platform:7"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-redis",
            "product": "Red Hat JBoss Enterprise Application Platform 7",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:jbosseapxp"
            ],
            "defaultStatus": "affected",
            "packageName": "netty-codec-redis",
            "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:red_hat_single_sign_on:7"
            ],
            "defaultStatus": "unaffected",
            "packageName": "netty-codec-redis",
            "product": "Red Hat Single Sign-On 7",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-11T20:49:00.487Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-05T12:15:03.342Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-44250"
          },
          {
            "name": "RHBZ#2488062",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44250.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41951"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50085"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:37390"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-11T22:01:16.373Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-11T20:49:00.487Z",
            "value": "Made public."
          }
        ],
        "title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this issue, restrict network access to services utilizing netty-codec-redis to trusted clients and networks only. Implement firewall rules to limit exposure of the Redis service or the application using it to prevent unauthenticated remote attackers from sending malicious payloads. This may impact legitimate client connections if not configured carefully. A service restart may be required for firewall rule changes to take effect."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "netty",
          "vendor": "netty",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.0.Final, \u003c 4.2.15.Final"
            },
            {
              "status": "affected",
              "version": "\u003c 4.1.135.Final"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T20:49:00.487Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"
        },
        {
          "name": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "name": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        }
      ],
      "source": {
        "advisory": "GHSA-3244-j874-rhc2",
        "discovery": "UNKNOWN"
      },
      "title": "Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44250",
    "datePublished": "2026-06-11T20:49:00.487Z",
    "dateReserved": "2026-05-05T16:33:55.844Z",
    "dateUpdated": "2026-08-05T12:15:03.342Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-44250",
      "date": "2026-08-10",
      "epss": "0.00449",
      "percentile": "0.36875"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-44250\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-06-11T22:16:56.857\",\"lastModified\":\"2026-08-05T13:22:48.290\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"netty\",\"product\":\"netty\",\"versions\":[{\"version\":\"\u003e= 4.2.0.Final, \u003c 4.2.15.Final\",\"status\":\"affected\"},{\"version\":\"\u003c 4.1.135.Final\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"],\"versions\":[{\"version\":\"codec-redis\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8.6.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"],\"versions\":[{\"version\":\"codec-redis\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"],\"versions\":[{\"version\":\"codec-redis\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-redis\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-redis\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-redis\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-redis\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-12T13:44:38.298945Z\",\"id\":\"CVE-2026-44250\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.1.135\",\"matchCriteriaId\":\"3097D962-A32D-4467-AAE7-F4CBA3A349D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2.0\",\"versionEndExcluding\":\"4.2.15\",\"matchCriteriaId\":\"413D4611-A46C-4BE4-AB2F-D86282F65984\"}]}]}],\"references\":[{\"url\":\"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37390\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41951\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50085\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-44250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2488062\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44250.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-04T17:19:04+00:00",
      "cve": "CVE-2026-44250",
      "id": "CVE-2026-44250",
      "initial_release_date": "2026-06-11T20:49:00.487000+00:00",
      "product_status:fixed": "3",
      "product_status:known_affected": "3",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44250.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-11T22:01:16.373Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-06-11T20:49:00.487Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-06-11T20:49:00.487Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-44250\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2488062\", \"name\": \"RHBZ#2488062\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44250.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37390\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this issue, restrict network access to services utilizing netty-codec-redis to trusted clients and networks only. Implement firewall rules to limit exposure of the Redis service or the application using it to prevent unauthenticated remote attackers from sending malicious payloads. This may impact legitimate client connections if not configured carefully. A service restart may be required for firewall rule changes to take effect.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-07-10T12:06:04.102Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-44250\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-12T13:44:38.298945Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-12T13:44:42.022Z\"}}], \"cna\": {\"title\": \"Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays\", \"source\": {\"advisory\": \"GHSA-3244-j874-rhc2\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"netty\", \"product\": \"netty\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.2.0.Final, \u003c 4.2.15.Final\"}, {\"status\": \"affected\", \"version\": \"\u003c 4.1.135.Final\"}]}], \"references\": [{\"url\": \"https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2\", \"name\": \"https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final\", \"name\": \"https://github.com/netty/netty/releases/tag/netty-4.1.135.Final\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final\", \"name\": \"https://github.com/netty/netty/releases/tag/netty-4.2.15.Final\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4.1.135.Final and 4.2.15.Final patch the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-06-11T20:49:00.487Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-44250\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-10T12:06:04.102Z\", \"dateReserved\": \"2026-05-05T16:33:55.844Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-06-11T20:49:00.487Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

WID-SEC-W-2026-1814

Vulnerability from csaf_certbund - Published: 2026-06-07 22:00 - Updated: 2026-08-04 22:00

Summary

Netty: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.

Betroffene Betriebssysteme: - Sonstiges - UNIX

CVE-2026-44249

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-44250

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-44890

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-44892

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-44893

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-44894

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-45416

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-45536

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-45673

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-45674

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-46340

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-47244

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-47691

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-48006

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-48043

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-48059

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-48748

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-50009

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-50010

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-50020

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

CVE-2026-50560

Affected products

Known affected 8 products

Product	Identifier	Version
IBM App Connect Enterprise IBM	`cpe:/a:ibm:app_connect_enterprise:professional`	—
SUSE Linux SUSE	`cpe:/o:suse:suse_linux:-`	—
IBM Sterling Connect:Direct IBM	`cpe:/a:ibm:sterling_connect%3adirect:-`	—
Red Hat Enterprise Linux Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:-`	—
Red Hat Enterprise Linux Data Grid 8 Red Hat / Enterprise Linux	`cpe:/o:redhat:enterprise_linux:data_grid_8`	Data Grid 8
IBM SPSS Analytic Server IBM / SPSS	`cpe:/a:ibm:spss:analytic_server`	Analytic Server
Open Source Netty <4.1.135.Final Open Source / Netty		<4.1.135.Final
Open Source Netty <4.2.15.Final Open Source / Netty		<4.2.15.Final

References

42 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://github.com/netty/netty/security/advisories/	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://github.com/netty/netty/security/advisorie…	external
https://access.redhat.com/errata/RHSA-2026:26018	external
https://access.redhat.com/errata/RHSA-2026:26017	external
https://access.redhat.com/errata/RHSA-2026:26586	external
https://access.redhat.com/errata/RHSA-2026:28573	external
https://www.ibm.com/support/pages/node/7277997	external
https://access.redhat.com/errata/RHSA-2026:34608	external
https://access.redhat.com/errata/RHSA-2026:36820	external
https://lists.suse.com/pipermail/sle-security-upd…	external
https://access.redhat.com/errata/RHSA-2026:37390	external
https://www.ibm.com/support/pages/node/7279709	external
https://access.redhat.com/errata/RHSA-2026:41951	external
https://www.ibm.com/support/pages/node/7280887	external
https://access.redhat.com/errata/RHSA-2026:48124	external
https://access.redhat.com/errata/RHSA-2026:48151	external
https://access.redhat.com/errata/RHSA-2026:49700	external
https://access.redhat.com/errata/RHSA-2026:49701	external
https://access.redhat.com/errata/RHSA-2026:50085	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework f\u00fcr die schnelle Entwicklung von wartbaren, hochleistungsf\u00e4higen Protokollservern und -clients.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1814 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1814.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1814 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1814"
      },
      {
        "category": "external",
        "summary": "Netty Security Advisories vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-3244-j874-rhc2 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-4grm-h2qv-h6w6 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-4grm-h2qv-h6w6"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-5pvg-856g-cp85 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-5w86-c3rq-vjj7 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-5x3r-wrvg-rp6q vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-5xrh-qmmq-w6ch vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-676x-f7gg-47vc vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-6ghj-frrj-jjj3 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-6jv9-x5w9-2ccm vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-c2gf-v879-257j vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-c2rx-5r8w-8xr2 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-c2rx-5r8w-8xr2"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-c653-97m9-rcg9 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-cc37-9q2j-3hfv vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-cmm3-54f8-px4j vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-cmm3-54f8-px4j"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-cq4q-cv5g-r8q5 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-cq4q-cv5g-r8q5"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-h2qv-fj59-j46j vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-hvcg-qmg6-jm4c vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-w573-9ffj-6ff9 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-x4gw-5cx5-pgmh vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-xmv7-r254-6q78 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78"
      },
      {
        "category": "external",
        "summary": "GitHub Security Advisory GHSA-xmv7-r254-6q78 vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
      },
      {
        "category": "external",
        "summary": "Netty Security Advisories vom 2026-06-07",
        "url": "https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:26018 vom 2026-06-17",
        "url": "https://access.redhat.com/errata/RHSA-2026:26018"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:26017 vom 2026-06-17",
        "url": "https://access.redhat.com/errata/RHSA-2026:26017"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:26586 vom 2026-06-18",
        "url": "https://access.redhat.com/errata/RHSA-2026:26586"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:28573 vom 2026-06-24",
        "url": "https://access.redhat.com/errata/RHSA-2026:28573"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7277997 vom 2026-06-25",
        "url": "https://www.ibm.com/support/pages/node/7277997"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:34608 vom 2026-07-02",
        "url": "https://access.redhat.com/errata/RHSA-2026:34608"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:36820 vom 2026-07-08",
        "url": "https://access.redhat.com/errata/RHSA-2026:36820"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2026:2802-1 vom 2026-07-09",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027331.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:37390 vom 2026-07-09",
        "url": "https://access.redhat.com/errata/RHSA-2026:37390"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7279709 vom 2026-07-10",
        "url": "https://www.ibm.com/support/pages/node/7279709"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:41951 vom 2026-07-20",
        "url": "https://access.redhat.com/errata/RHSA-2026:41951"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7280887 vom 2026-07-23",
        "url": "https://www.ibm.com/support/pages/node/7280887"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:48124 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:48124"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:48151 vom 2026-07-29",
        "url": "https://access.redhat.com/errata/RHSA-2026:48151"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:49700 vom 2026-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2026:49700"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:49701 vom 2026-08-03",
        "url": "https://access.redhat.com/errata/RHSA-2026:49701"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2026:50085 vom 2026-08-04",
        "url": "https://access.redhat.com/errata/RHSA-2026:50085"
      }
    ],
    "source_lang": "en-US",
    "title": "Netty: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-08-04T22:00:00.000+00:00",
      "generator": {
        "date": "2026-08-05T09:02:42.922+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1814",
      "initial_release_date": "2026-06-07T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-07T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-08T22:00:00.000+00:00",
          "number": "2",
          "summary": "CVE erg\u00e4nzt"
        },
        {
          "date": "2026-06-11T22:00:00.000+00:00",
          "number": "3",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-36327, EUVD-2026-36357, EUVD-2026-36356"
        },
        {
          "date": "2026-06-14T22:00:00.000+00:00",
          "number": "4",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-36432, EUVD-2026-36450, EUVD-2026-36471, EUVD-2026-36465, EUVD-2026-36459, EUVD-2026-36451, EUVD-2026-36445, EUVD-2026-36457, EUVD-2026-36494, EUVD-2026-36468, EUVD-2026-36436, EUVD-2026-36439, EUVD-2026-36435, EUVD-2026-36489, EUVD-2026-36492"
        },
        {
          "date": "2026-06-15T22:00:00.000+00:00",
          "number": "5",
          "summary": "Referenz(en) aufgenommen: CVE-2026-50009"
        },
        {
          "date": "2026-06-17T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-23T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-06-25T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-07-01T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-08T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-09T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat und IBM aufgenommen"
        },
        {
          "date": "2026-07-20T22:00:00.000+00:00",
          "number": "12",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-07-22T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-07-29T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-08-03T22:00:00.000+00:00",
          "number": "15",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2026-08-04T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "16"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "IBM App Connect Enterprise",
            "product": {
              "name": "IBM App Connect Enterprise",
              "product_id": "T037507",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:app_connect_enterprise:professional"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Analytic Server",
                "product": {
                  "name": "IBM SPSS Analytic Server",
                  "product_id": "T011787",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spss:analytic_server"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SPSS"
          },
          {
            "category": "product_name",
            "name": "IBM Sterling Connect:Direct",
            "product": {
              "name": "IBM Sterling Connect:Direct",
              "product_id": "T045428",
              "product_identification_helper": {
                "cpe": "cpe:/a:ibm:sterling_connect%3adirect:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c4.2.15.Final",
                "product": {
                  "name": "Open Source Netty \u003c4.2.15.Final",
                  "product_id": "T055037"
                }
              },
              {
                "category": "product_version",
                "name": "4.2.15.Final",
                "product": {
                  "name": "Open Source Netty 4.2.15.Final",
                  "product_id": "T055037-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netty:netty:4.2.15.final"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c4.1.135.Final",
                "product": {
                  "name": "Open Source Netty \u003c4.1.135.Final",
                  "product_id": "T055038"
                }
              },
              {
                "category": "product_version",
                "name": "4.1.135.Final",
                "product": {
                  "name": "Open Source Netty 4.1.135.Final",
                  "product_id": "T055038-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:netty:netty:4.1.135.final"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Netty"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux",
                "product": {
                  "name": "Red Hat Enterprise Linux",
                  "product_id": "67646",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:-"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "Data Grid 8",
                "product": {
                  "name": "Red Hat Enterprise Linux Data Grid 8",
                  "product_id": "T056825",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:enterprise_linux:data_grid_8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Enterprise Linux"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44249",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-44249"
    },
    {
      "cve": "CVE-2026-44250",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-44250"
    },
    {
      "cve": "CVE-2026-44890",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-44890"
    },
    {
      "cve": "CVE-2026-44892",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-44892"
    },
    {
      "cve": "CVE-2026-44893",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-44893"
    },
    {
      "cve": "CVE-2026-44894",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-44894"
    },
    {
      "cve": "CVE-2026-45416",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-45416"
    },
    {
      "cve": "CVE-2026-45536",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-45536"
    },
    {
      "cve": "CVE-2026-45673",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-45673"
    },
    {
      "cve": "CVE-2026-45674",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-45674"
    },
    {
      "cve": "CVE-2026-46340",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-46340"
    },
    {
      "cve": "CVE-2026-47244",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-47244"
    },
    {
      "cve": "CVE-2026-47691",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-47691"
    },
    {
      "cve": "CVE-2026-48006",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-48006"
    },
    {
      "cve": "CVE-2026-48043",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-48043"
    },
    {
      "cve": "CVE-2026-48059",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-48059"
    },
    {
      "cve": "CVE-2026-48748",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-48748"
    },
    {
      "cve": "CVE-2026-50009",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-50009"
    },
    {
      "cve": "CVE-2026-50010",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-50010"
    },
    {
      "cve": "CVE-2026-50020",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-50020"
    },
    {
      "cve": "CVE-2026-50560",
      "product_status": {
        "known_affected": [
          "T037507",
          "T002207",
          "T045428",
          "67646",
          "T056825",
          "T011787",
          "T055038",
          "T055037"
        ]
      },
      "release_date": "2026-06-07T22:00:00.000+00:00",
      "title": "CVE-2026-50560"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-44250 (GCVE-0-2026-44250)

WID-SEC-W-2026-1814

Tags

Sightings

Nomenclature