OPENSUSE-SU-2026:11882-1
Vulnerability from csaf_opensuse - Published: 2026-09-24 00:00 - Updated: 2026-09-25 08:57Summary
netty-4.1.138-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: netty-4.1.138-1.1 on GA media
Description of the patch: These are all security issues fixed in the netty-4.1.138-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11882
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
8.3 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
8.2 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
7.4 (High)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
16 products, the same list as for
CVE-2026-59902
Threats
Impact
moderate
References
93 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "netty-4.1.138-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the netty-4.1.138-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-11882",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11882-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59902 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59902/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-59903 page",
"url": "https://www.suse.com/security/cve/CVE-2026-59903/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-62243 page",
"url": "https://www.suse.com/security/cve/CVE-2026-62243/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-62380 page",
"url": "https://www.suse.com/security/cve/CVE-2026-62380/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-75595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-75595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-75596 page",
"url": "https://www.suse.com/security/cve/CVE-2026-75596/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-76816 page",
"url": "https://www.suse.com/security/cve/CVE-2026-76816/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-89044 page",
"url": "https://www.suse.com/security/cve/CVE-2026-89044/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93488 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93488/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93491 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93491/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93492 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93492/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93493 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93493/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93494 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93494/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93558 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93558/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93560 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93560/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93562 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93562/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93563 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93563/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93564 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93564/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93565 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93565/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93566 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93566/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93567 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93567/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93568 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93568/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93569 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93569/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93572 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93572/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93573 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93573/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93574 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93574/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93575 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93575/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93576 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93576/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93578 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93578/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-93579 page",
"url": "https://www.suse.com/security/cve/CVE-2026-93579/"
}
],
"title": "netty-4.1.138-1.1 on GA media",
"tracking": {
"current_release_date": "2026-09-25T08:57:25Z",
"generator": {
"date": "2026-09-24T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:11882-1",
"initial_release_date": "2026-09-24T00:00:00Z",
"revision_history": [
{
"date": "2026-09-24T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-25T08:57:25Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "netty-0:4.1.138-1.1.aarch64",
"product": {
"name": "netty-0:4.1.138-1.1.aarch64",
"product_id": "netty-0:4.1.138-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.138:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty@4.1.138-1.1?arch=aarch64\u0026upstream=netty-0:4.1.138-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-bom-0:4.1.138-1.1.aarch64",
"product": {
"name": "netty-bom-0:4.1.138-1.1.aarch64",
"product_id": "netty-bom-0:4.1.138-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-bom@4.1.138-1.1?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "netty-javadoc-0:4.1.138-1.1.aarch64",
"product": {
"name": "netty-javadoc-0:4.1.138-1.1.aarch64",
"product_id": "netty-javadoc-0:4.1.138-1.1.aarch64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.138:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty-javadoc@4.1.138-1.1?arch=aarch64\u0026upstream=netty-0:4.1.138-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-parent-0:4.1.138-1.1.aarch64",
"product": {
"name": "netty-parent-0:4.1.138-1.1.aarch64",
"product_id": "netty-parent-0:4.1.138-1.1.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-parent@4.1.138-1.1?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-0:4.1.138-1.1.ppc64le",
"product": {
"name": "netty-0:4.1.138-1.1.ppc64le",
"product_id": "netty-0:4.1.138-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.138:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty@4.1.138-1.1?arch=ppc64le\u0026upstream=netty-0:4.1.138-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-bom-0:4.1.138-1.1.ppc64le",
"product": {
"name": "netty-bom-0:4.1.138-1.1.ppc64le",
"product_id": "netty-bom-0:4.1.138-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-bom@4.1.138-1.1?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "netty-javadoc-0:4.1.138-1.1.ppc64le",
"product": {
"name": "netty-javadoc-0:4.1.138-1.1.ppc64le",
"product_id": "netty-javadoc-0:4.1.138-1.1.ppc64le",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.138:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty-javadoc@4.1.138-1.1?arch=ppc64le\u0026upstream=netty-0:4.1.138-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-parent-0:4.1.138-1.1.ppc64le",
"product": {
"name": "netty-parent-0:4.1.138-1.1.ppc64le",
"product_id": "netty-parent-0:4.1.138-1.1.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-parent@4.1.138-1.1?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-0:4.1.138-1.1.s390x",
"product": {
"name": "netty-0:4.1.138-1.1.s390x",
"product_id": "netty-0:4.1.138-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.138:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty@4.1.138-1.1?arch=s390x\u0026upstream=netty-0:4.1.138-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-bom-0:4.1.138-1.1.s390x",
"product": {
"name": "netty-bom-0:4.1.138-1.1.s390x",
"product_id": "netty-bom-0:4.1.138-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-bom@4.1.138-1.1?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "netty-javadoc-0:4.1.138-1.1.s390x",
"product": {
"name": "netty-javadoc-0:4.1.138-1.1.s390x",
"product_id": "netty-javadoc-0:4.1.138-1.1.s390x",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.138:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty-javadoc@4.1.138-1.1?arch=s390x\u0026upstream=netty-0:4.1.138-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-parent-0:4.1.138-1.1.s390x",
"product": {
"name": "netty-parent-0:4.1.138-1.1.s390x",
"product_id": "netty-parent-0:4.1.138-1.1.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-parent@4.1.138-1.1?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-0:4.1.138-1.1.x86_64",
"product": {
"name": "netty-0:4.1.138-1.1.x86_64",
"product_id": "netty-0:4.1.138-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.138:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty@4.1.138-1.1?arch=x86_64\u0026upstream=netty-0:4.1.138-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-bom-0:4.1.138-1.1.x86_64",
"product": {
"name": "netty-bom-0:4.1.138-1.1.x86_64",
"product_id": "netty-bom-0:4.1.138-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-bom@4.1.138-1.1?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "netty-javadoc-0:4.1.138-1.1.x86_64",
"product": {
"name": "netty-javadoc-0:4.1.138-1.1.x86_64",
"product_id": "netty-javadoc-0:4.1.138-1.1.x86_64",
"product_identification_helper": {
"cpe": "cpe:2.3:a:netty:netty:4.1.138:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/netty-javadoc@4.1.138-1.1?arch=x86_64\u0026upstream=netty-0:4.1.138-1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "netty-parent-0:4.1.138-1.1.x86_64",
"product": {
"name": "netty-parent-0:4.1.138-1.1.x86_64",
"product_id": "netty-parent-0:4.1.138-1.1.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/netty-parent@4.1.138-1.1?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-0:4.1.138-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64"
},
"product_reference": "netty-0:4.1.138-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-0:4.1.138-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le"
},
"product_reference": "netty-0:4.1.138-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-0:4.1.138-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x"
},
"product_reference": "netty-0:4.1.138-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-0:4.1.138-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64"
},
"product_reference": "netty-0:4.1.138-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-0:4.1.138-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64"
},
"product_reference": "netty-bom-0:4.1.138-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-0:4.1.138-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le"
},
"product_reference": "netty-bom-0:4.1.138-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-0:4.1.138-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x"
},
"product_reference": "netty-bom-0:4.1.138-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-0:4.1.138-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64"
},
"product_reference": "netty-bom-0:4.1.138-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-0:4.1.138-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64"
},
"product_reference": "netty-javadoc-0:4.1.138-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-0:4.1.138-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le"
},
"product_reference": "netty-javadoc-0:4.1.138-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-0:4.1.138-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x"
},
"product_reference": "netty-javadoc-0:4.1.138-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-0:4.1.138-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64"
},
"product_reference": "netty-javadoc-0:4.1.138-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-0:4.1.138-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64"
},
"product_reference": "netty-parent-0:4.1.138-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-0:4.1.138-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le"
},
"product_reference": "netty-parent-0:4.1.138-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-0:4.1.138-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x"
},
"product_reference": "netty-parent-0:4.1.138-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-0:4.1.138-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
},
"product_reference": "netty-parent-0:4.1.138-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-59902",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59902"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59902",
"url": "https://www.suse.com/security/cve/CVE-2026-59902"
},
{
"category": "external",
"summary": "SUSE Bug 1275501 for CVE-2026-59902",
"url": "https://bugzilla.suse.com/1275501"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-59902"
},
{
"cve": "CVE-2026-59903",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-59903"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-59903",
"url": "https://www.suse.com/security/cve/CVE-2026-59903"
},
{
"category": "external",
"summary": "SUSE Bug 1275500 for CVE-2026-59903",
"url": "https://bugzilla.suse.com/1275500"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-59903"
},
{
"cve": "CVE-2026-62243",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-62243"
}
],
"notes": [
{
"category": "general",
"text": "Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-62243",
"url": "https://www.suse.com/security/cve/CVE-2026-62243"
},
{
"category": "external",
"summary": "SUSE Bug 1276455 for CVE-2026-62243",
"url": "https://bugzilla.suse.com/1276455"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-62243"
},
{
"cve": "CVE-2026-62380",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-62380"
}
],
"notes": [
{
"category": "general",
"text": "Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject null bytes or CRLF characters to truncate or alter values, potentially enabling domain spoofing, SOCKS4 userid truncation, authentication data injection, and protocol confusion. Fixed in 4.2.17.Final and 4.1.137.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-62380",
"url": "https://www.suse.com/security/cve/CVE-2026-62380"
},
{
"category": "external",
"summary": "SUSE Bug 1276456 for CVE-2026-62380",
"url": "https://bugzilla.suse.com/1276456"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-62380"
},
{
"cve": "CVE-2026-75595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-75595"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route\u0027s mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-75595",
"url": "https://www.suse.com/security/cve/CVE-2026-75595"
},
{
"category": "external",
"summary": "SUSE Bug 1276420 for CVE-2026-75595",
"url": "https://bugzilla.suse.com/1276420"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-75595"
},
{
"cve": "CVE-2026-75596",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-75596"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-75596",
"url": "https://www.suse.com/security/cve/CVE-2026-75596"
},
{
"category": "external",
"summary": "SUSE Bug 1276421 for CVE-2026-75596",
"url": "https://bugzilla.suse.com/1276421"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-75596"
},
{
"cve": "CVE-2026-76816",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-76816"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields and potentially causing routing, access-control, or identity mismatches in downstream brokers. The vulnerability is exploitable when an application uses Netty\u0027s MQTT encoder to construct messages from user-controlled input. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-76816",
"url": "https://www.suse.com/security/cve/CVE-2026-76816"
},
{
"category": "external",
"summary": "SUSE Bug 1277243 for CVE-2026-76816",
"url": "https://bugzilla.suse.com/1277243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-76816"
},
{
"cve": "CVE-2026-89044",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-89044"
}
],
"notes": [
{
"category": "general",
"text": "Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like \u0027chunked, xchunked\u0027 to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-89044",
"url": "https://www.suse.com/security/cve/CVE-2026-89044"
},
{
"category": "external",
"summary": "SUSE Bug 1280048 for CVE-2026-89044",
"url": "https://bugzilla.suse.com/1280048"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-89044"
},
{
"cve": "CVE-2026-93488",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93488"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93488",
"url": "https://www.suse.com/security/cve/CVE-2026-93488"
},
{
"category": "external",
"summary": "SUSE Bug 1282084 for CVE-2026-93488",
"url": "https://bugzilla.suse.com/1282084"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93488"
},
{
"cve": "CVE-2026-93491",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93491"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93491",
"url": "https://www.suse.com/security/cve/CVE-2026-93491"
},
{
"category": "external",
"summary": "SUSE Bug 1282085 for CVE-2026-93491",
"url": "https://bugzilla.suse.com/1282085"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93491"
},
{
"cve": "CVE-2026-93492",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93492"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93492",
"url": "https://www.suse.com/security/cve/CVE-2026-93492"
},
{
"category": "external",
"summary": "SUSE Bug 1282132 for CVE-2026-93492",
"url": "https://bugzilla.suse.com/1282132"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-93492"
},
{
"cve": "CVE-2026-93493",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93493"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) response that omits the optional `nextUpdate` field. This omission causes the OCSP validation to be silently skipped, leading to applications proceeding with an unvalidated certificate. This can result in a bypass of security controls where certificate validation is expected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93493",
"url": "https://www.suse.com/security/cve/CVE-2026-93493"
},
{
"category": "external",
"summary": "SUSE Bug 1281431 for CVE-2026-93493",
"url": "https://bugzilla.suse.com/1281431"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93493"
},
{
"cve": "CVE-2026-93494",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93494"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93494",
"url": "https://www.suse.com/security/cve/CVE-2026-93494"
},
{
"category": "external",
"summary": "SUSE Bug 1282506 for CVE-2026-93494",
"url": "https://bugzilla.suse.com/1282506"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-93494"
},
{
"cve": "CVE-2026-93558",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93558"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93558",
"url": "https://www.suse.com/security/cve/CVE-2026-93558"
},
{
"category": "external",
"summary": "SUSE Bug 1282140 for CVE-2026-93558",
"url": "https://bugzilla.suse.com/1282140"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93558"
},
{
"cve": "CVE-2026-93560",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93560"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93560",
"url": "https://www.suse.com/security/cve/CVE-2026-93560"
},
{
"category": "external",
"summary": "SUSE Bug 1282141 for CVE-2026-93560",
"url": "https://bugzilla.suse.com/1282141"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93560"
},
{
"cve": "CVE-2026-93562",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93562"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93562",
"url": "https://www.suse.com/security/cve/CVE-2026-93562"
},
{
"category": "external",
"summary": "SUSE Bug 1282362 for CVE-2026-93562",
"url": "https://bugzilla.suse.com/1282362"
},
{
"category": "external",
"summary": "SUSE Bug 1282373 for CVE-2026-93562",
"url": "https://bugzilla.suse.com/1282373"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-93562"
},
{
"cve": "CVE-2026-93563",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93563"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client\u0027s Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93563",
"url": "https://www.suse.com/security/cve/CVE-2026-93563"
},
{
"category": "external",
"summary": "SUSE Bug 1281432 for CVE-2026-93563",
"url": "https://bugzilla.suse.com/1281432"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93563"
},
{
"cve": "CVE-2026-93564",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93564"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93564",
"url": "https://www.suse.com/security/cve/CVE-2026-93564"
},
{
"category": "external",
"summary": "SUSE Bug 1282363 for CVE-2026-93564",
"url": "https://bugzilla.suse.com/1282363"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93564"
},
{
"cve": "CVE-2026-93565",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93565"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93565",
"url": "https://www.suse.com/security/cve/CVE-2026-93565"
},
{
"category": "external",
"summary": "SUSE Bug 1282364 for CVE-2026-93565",
"url": "https://bugzilla.suse.com/1282364"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93565"
},
{
"cve": "CVE-2026-93566",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93566"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93566",
"url": "https://www.suse.com/security/cve/CVE-2026-93566"
},
{
"category": "external",
"summary": "SUSE Bug 1282366 for CVE-2026-93566",
"url": "https://bugzilla.suse.com/1282366"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-93566"
},
{
"cve": "CVE-2026-93567",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93567"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93567",
"url": "https://www.suse.com/security/cve/CVE-2026-93567"
},
{
"category": "external",
"summary": "SUSE Bug 1282367 for CVE-2026-93567",
"url": "https://bugzilla.suse.com/1282367"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93567"
},
{
"cve": "CVE-2026-93568",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93568"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty\u0027s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93568",
"url": "https://www.suse.com/security/cve/CVE-2026-93568"
},
{
"category": "external",
"summary": "SUSE Bug 1282370 for CVE-2026-93568",
"url": "https://bugzilla.suse.com/1282370"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93568"
},
{
"cve": "CVE-2026-93569",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93569"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty\u0027s HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93569",
"url": "https://www.suse.com/security/cve/CVE-2026-93569"
},
{
"category": "external",
"summary": "SUSE Bug 1282372 for CVE-2026-93569",
"url": "https://bugzilla.suse.com/1282372"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93569"
},
{
"cve": "CVE-2026-93572",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93572"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using `RedisDecoder` with `RedisArrayAggregator` on untrusted traffic.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93572",
"url": "https://www.suse.com/security/cve/CVE-2026-93572"
},
{
"category": "external",
"summary": "SUSE Bug 1281433 for CVE-2026-93572",
"url": "https://bugzilla.suse.com/1281433"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93572"
},
{
"cve": "CVE-2026-93573",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93573"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93573",
"url": "https://www.suse.com/security/cve/CVE-2026-93573"
},
{
"category": "external",
"summary": "SUSE Bug 1282373 for CVE-2026-93573",
"url": "https://bugzilla.suse.com/1282373"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-93573"
},
{
"cve": "CVE-2026-93574",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93574"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93574",
"url": "https://www.suse.com/security/cve/CVE-2026-93574"
},
{
"category": "external",
"summary": "SUSE Bug 1282374 for CVE-2026-93574",
"url": "https://bugzilla.suse.com/1282374"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-93574"
},
{
"cve": "CVE-2026-93575",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93575"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the \u0027Properties Length\u0027 against the \u0027Remaining Length\u0027, allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93575",
"url": "https://www.suse.com/security/cve/CVE-2026-93575"
},
{
"category": "external",
"summary": "SUSE Bug 1281434 for CVE-2026-93575",
"url": "https://bugzilla.suse.com/1281434"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93575"
},
{
"cve": "CVE-2026-93576",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93576"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93576",
"url": "https://www.suse.com/security/cve/CVE-2026-93576"
},
{
"category": "external",
"summary": "SUSE Bug 1282507 for CVE-2026-93576",
"url": "https://bugzilla.suse.com/1282507"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93576"
},
{
"cve": "CVE-2026-93578",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93578"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s Online Certificate Status Protocol (OCSP) Client. The client fails to verify the \u0027id-kp-OCSPSigning\u0027 Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging \u0027GOOD\u0027 OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty\u0027s OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93578",
"url": "https://www.suse.com/security/cve/CVE-2026-93578"
},
{
"category": "external",
"summary": "SUSE Bug 1281435 for CVE-2026-93578",
"url": "https://bugzilla.suse.com/1281435"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-93578"
},
{
"cve": "CVE-2026-93579",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-93579"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in Netty\u0027s HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-93579",
"url": "https://www.suse.com/security/cve/CVE-2026-93579"
},
{
"category": "external",
"summary": "SUSE Bug 1282378 for CVE-2026-93579",
"url": "https://bugzilla.suse.com/1282378"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-0:4.1.138-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-0:4.1.138-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-24T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-93579"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…