SUSE-SU-2026:1353-1

Vulnerability from csaf_suse - Published: 2026-04-15 13:37 - Updated: 2026-04-15 13:37
Summary
Security update for netty, netty-tcnative
Severity
Important
Notes
Title of the patch: Security update for netty, netty-tcnative
Description of the patch: This update for netty, netty-tcnative fixes the following issues: Upidate to 4.1.132: - CVE-2026-33870: incorrectly parses quoted strings in HTTP/1.1 can lead to request smuggling (bsc#1261031). - CVE-2026-33871: sending a flood of CONTINUATION frames can lead to a denial of service (bsc#1261043). Changelog: - Upgrade to upstream version 4.1.132 * Fixes: + Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry loop + Make RefCntOpenSslContext.deallocate more robust + HTTP2: Correctly account for padding when decompress + Fix high-order bit aliasing in HttpUtil.validateToken + fix: the precedence of + is higher than >> + AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater than byteBuf.maxCapacity() + AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed + Don't assume CertificateFactory is thread-safe + Fix HttpObjectAggregator leaving connection stuck after 413 with AUTO_READ=false + HTTP2: Ensure preface is flushed in all cases + Fix UnsupportedOperationException in readTrailingHeaders + Fix client_max_window_bits parameter handling in permessage-deflate extension + Native transports: Fix possible fd leak when fcntl fails. + Kqueue: Fix undefined behaviour when GetStringUTFChars fails and SO_ACCEPTFILTER is supported + Kqueue: Possible overflow when using netty_kqueue_bsdsocket_setAcceptFilter(...) + Native transports: Fix undefined behaviour when GetStringUTFChars fails while open FD + Epoll: Add null checks for safety reasons + Epoll: Use correct value to initialize mmsghdr.msg_namelen + Epoll: Fix support for IP_RECVORIGDSTADDR + AdaptivePoolingAllocator: remove ensureAccessible() call in capacity(int) method + Epoll: setTcpMg5Sig(...) might overflow + JdkZlibDecoder: accumulate decompressed output before firing channelRead + Limit the number of Continuation frames per HTTP2 Headers (bsc#1261043, CVE-2026-33871) + Stricter HTTP/1.1 chunk extension parsing (bsc#1261031, CVE-2026-33870) + rediff - Upgrade to upstream version 4.1.131 + NioDatagramChannel.block(...) does not early return on failure + Support for AWS Libcrypto (AWS-LC) netty-tcnative build + codec-dns: Decompress MX RDATA exchange domain names during DNS record decoding + Buddy allocation for large buffers in adaptive allocator + SslHandler: Only resume on EventLoop if EventLoop is not shutting down already + Wrap ECONNREFUSED in PortUnreachableException for UDP + Bump com.ning:compress-lzf (4.1) + Fix adaptive allocator bug from not noticing failed allocation + Avoid loosing original read exception + Backport multiple adaptive allocator changes - Upgrade to version 4.1.130 - Upgrade to version 2.0.75 Final * No formal changelog present * Needed by netty >= 4.2.11
Patchnames: SUSE-2026-1353,SUSE-SLE-Module-Development-Tools-15-SP7-2026-1353,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1353,openSUSE-SLE-15.6-2026-1353
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-33870
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.s390x —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.x86_64 —
Vendor Fix
Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-javadoc-4.1.132-150200.4.43.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-javadoc-4.1.132-150200.4.43.1.noarch —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.6:netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch —
Vendor Fix
Threats
Impact important
CVE-2026-33871
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 19 products, the same list as for CVE-2026-33870
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for netty, netty-tcnative",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for netty, netty-tcnative fixes the following issues:\n\nUpidate to 4.1.132:\n\n- CVE-2026-33870: incorrectly parses quoted strings in HTTP/1.1 can lead to request smuggling (bsc#1261031).\n- CVE-2026-33871: sending a flood of CONTINUATION frames can lead to a denial of service (bsc#1261043).\n\nChangelog:\n\n- Upgrade to upstream version 4.1.132\n * Fixes:\n + Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR\n retry loop\n + Make RefCntOpenSslContext.deallocate more robust\n + HTTP2: Correctly account for padding when decompress\n + Fix high-order bit aliasing in HttpUtil.validateToken\n + fix: the precedence of + is higher than \u003e\u003e\n + AdaptiveByteBufAllocator: make sure byteBuf.capacity() not\n greater than byteBuf.maxCapacity()\n + AdaptivePoolingAllocator: call unreserveMatchingBuddy(...)\n if byteBuf initialization failed\n + Don\u0027t assume CertificateFactory is thread-safe\n + Fix HttpObjectAggregator leaving connection stuck after 413\n with AUTO_READ=false\n + HTTP2: Ensure preface is flushed in all cases\n + Fix UnsupportedOperationException in readTrailingHeaders\n + Fix client_max_window_bits parameter handling in\n permessage-deflate extension\n + Native transports: Fix possible fd leak when fcntl fails.\n + Kqueue: Fix undefined behaviour when GetStringUTFChars fails\n and SO_ACCEPTFILTER is supported\n + Kqueue: Possible overflow when using\n netty_kqueue_bsdsocket_setAcceptFilter(...)\n + Native transports: Fix undefined behaviour when\n GetStringUTFChars fails while open FD\n + Epoll: Add null checks for safety reasons\n + Epoll: Use correct value to initialize mmsghdr.msg_namelen\n + Epoll: Fix support for IP_RECVORIGDSTADDR\n + AdaptivePoolingAllocator: remove ensureAccessible() call in\n capacity(int) method\n + Epoll: setTcpMg5Sig(...) might overflow\n + JdkZlibDecoder: accumulate decompressed output before firing\n channelRead\n + Limit the number of Continuation frames per HTTP2 Headers\n (bsc#1261043, CVE-2026-33871)\n + Stricter HTTP/1.1 chunk extension parsing (bsc#1261031,\n CVE-2026-33870)\n + rediff\n- Upgrade to upstream version 4.1.131\n + NioDatagramChannel.block(...) does not early return on failure\n + Support for AWS Libcrypto (AWS-LC) netty-tcnative build\n + codec-dns: Decompress MX RDATA exchange domain names during\n DNS record decoding\n + Buddy allocation for large buffers in adaptive allocator\n + SslHandler: Only resume on EventLoop if EventLoop is not\n shutting down already\n + Wrap ECONNREFUSED in PortUnreachableException for UDP\n + Bump com.ning:compress-lzf (4.1)\n + Fix adaptive allocator bug from not noticing failed allocation\n + Avoid loosing original read exception\n + Backport multiple adaptive allocator changes\n- Upgrade to version 4.1.130\n- Upgrade to version 2.0.75 Final\n * No formal changelog present\n * Needed by netty \u003e= 4.2.11\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2026-1353,SUSE-SLE-Module-Development-Tools-15-SP7-2026-1353,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-1353,openSUSE-SLE-15.6-2026-1353",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_1353-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:1353-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20261353-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:1353-1",
        "url": "https://lists.suse.com/pipermail/sle-updates/2026-April/045563.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261031",
        "url": "https://bugzilla.suse.com/1261031"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1261043",
        "url": "https://bugzilla.suse.com/1261043"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33870 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33870/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-33871 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-33871/"
      }
    ],
    "title": "Security update for netty, netty-tcnative",
    "tracking": {
      "current_release_date": "2026-04-15T13:37:19Z",
      "generator": {
        "date": "2026-04-15T13:37:19Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:1353-1",
      "initial_release_date": "2026-04-15T13:37:19Z",
      "revision_history": [
        {
          "date": "2026-04-15T13:37:19Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.132-150200.4.43.1.aarch64",
                "product": {
                  "name": "netty-4.1.132-150200.4.43.1.aarch64",
                  "product_id": "netty-4.1.132-150200.4.43.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.75-150200.3.36.1.aarch64",
                "product": {
                  "name": "netty-tcnative-2.0.75-150200.3.36.1.aarch64",
                  "product_id": "netty-tcnative-2.0.75-150200.3.36.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.aarch64",
                "product": {
                  "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.aarch64",
                  "product_id": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.132-150200.4.43.1.i586",
                "product": {
                  "name": "netty-4.1.132-150200.4.43.1.i586",
                  "product_id": "netty-4.1.132-150200.4.43.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.75-150200.3.36.1.i586",
                "product": {
                  "name": "netty-tcnative-2.0.75-150200.3.36.1.i586",
                  "product_id": "netty-tcnative-2.0.75-150200.3.36.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.i586",
                "product": {
                  "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.i586",
                  "product_id": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-bom-4.1.132-150200.4.43.1.noarch",
                "product": {
                  "name": "netty-bom-4.1.132-150200.4.43.1.noarch",
                  "product_id": "netty-bom-4.1.132-150200.4.43.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "netty-javadoc-4.1.132-150200.4.43.1.noarch",
                "product": {
                  "name": "netty-javadoc-4.1.132-150200.4.43.1.noarch",
                  "product_id": "netty-javadoc-4.1.132-150200.4.43.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "netty-parent-4.1.132-150200.4.43.1.noarch",
                "product": {
                  "name": "netty-parent-4.1.132-150200.4.43.1.noarch",
                  "product_id": "netty-parent-4.1.132-150200.4.43.1.noarch"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch",
                "product": {
                  "name": "netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch",
                  "product_id": "netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch"
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.132-150200.4.43.1.ppc64le",
                "product": {
                  "name": "netty-4.1.132-150200.4.43.1.ppc64le",
                  "product_id": "netty-4.1.132-150200.4.43.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
                "product": {
                  "name": "netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
                  "product_id": "netty-tcnative-2.0.75-150200.3.36.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.ppc64le",
                "product": {
                  "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.ppc64le",
                  "product_id": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.132-150200.4.43.1.s390x",
                "product": {
                  "name": "netty-4.1.132-150200.4.43.1.s390x",
                  "product_id": "netty-4.1.132-150200.4.43.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.75-150200.3.36.1.s390x",
                "product": {
                  "name": "netty-tcnative-2.0.75-150200.3.36.1.s390x",
                  "product_id": "netty-tcnative-2.0.75-150200.3.36.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.s390x",
                "product": {
                  "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.s390x",
                  "product_id": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "netty-4.1.132-150200.4.43.1.x86_64",
                "product": {
                  "name": "netty-4.1.132-150200.4.43.1.x86_64",
                  "product_id": "netty-4.1.132-150200.4.43.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-2.0.75-150200.3.36.1.x86_64",
                "product": {
                  "name": "netty-tcnative-2.0.75-150200.3.36.1.x86_64",
                  "product_id": "netty-tcnative-2.0.75-150200.3.36.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.x86_64",
                "product": {
                  "name": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.x86_64",
                  "product_id": "netty-tcnative-openssl-dynamic-2.0.75-150200.3.36.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-module-development-tools:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                "product": {
                  "name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:packagehub:15:sp7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.6",
                "product": {
                  "name": "openSUSE Leap 15.6",
                  "product_id": "openSUSE Leap 15.6",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.75-150200.3.36.1.aarch64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.75-150200.3.36.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.75-150200.3.36.1.ppc64le as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.75-150200.3.36.1.s390x as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.s390x"
        },
        "product_reference": "netty-tcnative-2.0.75-150200.3.36.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.75-150200.3.36.1.x86_64 as component of SUSE Linux Enterprise Module for Development Tools 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.75-150200.3.36.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Development Tools 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.132-150200.4.43.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.aarch64"
        },
        "product_reference": "netty-4.1.132-150200.4.43.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.132-150200.4.43.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.ppc64le"
        },
        "product_reference": "netty-4.1.132-150200.4.43.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.132-150200.4.43.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.s390x"
        },
        "product_reference": "netty-4.1.132-150200.4.43.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.132-150200.4.43.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.x86_64"
        },
        "product_reference": "netty-4.1.132-150200.4.43.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-javadoc-4.1.132-150200.4.43.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
          "product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-javadoc-4.1.132-150200.4.43.1.noarch"
        },
        "product_reference": "netty-javadoc-4.1.132-150200.4.43.1.noarch",
        "relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.132-150200.4.43.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.aarch64"
        },
        "product_reference": "netty-4.1.132-150200.4.43.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.132-150200.4.43.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.ppc64le"
        },
        "product_reference": "netty-4.1.132-150200.4.43.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.132-150200.4.43.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.s390x"
        },
        "product_reference": "netty-4.1.132-150200.4.43.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-4.1.132-150200.4.43.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.x86_64"
        },
        "product_reference": "netty-4.1.132-150200.4.43.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-javadoc-4.1.132-150200.4.43.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-javadoc-4.1.132-150200.4.43.1.noarch"
        },
        "product_reference": "netty-javadoc-4.1.132-150200.4.43.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.75-150200.3.36.1.aarch64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.aarch64"
        },
        "product_reference": "netty-tcnative-2.0.75-150200.3.36.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.75-150200.3.36.1.ppc64le as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.ppc64le"
        },
        "product_reference": "netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.75-150200.3.36.1.s390x as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.s390x"
        },
        "product_reference": "netty-tcnative-2.0.75-150200.3.36.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-2.0.75-150200.3.36.1.x86_64 as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.x86_64"
        },
        "product_reference": "netty-tcnative-2.0.75-150200.3.36.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch as component of openSUSE Leap 15.6",
          "product_id": "openSUSE Leap 15.6:netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch"
        },
        "product_reference": "netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch",
        "relates_to_product_reference": "openSUSE Leap 15.6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-33870",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33870"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-javadoc-4.1.132-150200.4.43.1.noarch",
          "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.aarch64",
          "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.ppc64le",
          "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.s390x",
          "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.x86_64",
          "openSUSE Leap 15.6:netty-javadoc-4.1.132-150200.4.43.1.noarch",
          "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
          "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
          "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.s390x",
          "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
          "openSUSE Leap 15.6:netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33870",
          "url": "https://www.suse.com/security/cve/CVE-2026-33870"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261031 for CVE-2026-33870",
          "url": "https://bugzilla.suse.com/1261031"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-javadoc-4.1.132-150200.4.43.1.noarch",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.aarch64",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.ppc64le",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.s390x",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.x86_64",
            "openSUSE Leap 15.6:netty-javadoc-4.1.132-150200.4.43.1.noarch",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.s390x",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
            "openSUSE Leap 15.6:netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-javadoc-4.1.132-150200.4.43.1.noarch",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.aarch64",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.ppc64le",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.s390x",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.x86_64",
            "openSUSE Leap 15.6:netty-javadoc-4.1.132-150200.4.43.1.noarch",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.s390x",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
            "openSUSE Leap 15.6:netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-15T13:37:19Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-33870"
    },
    {
      "cve": "CVE-2026-33871",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-33871"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server\u0027s lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.s390x",
          "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.aarch64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.ppc64le",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.s390x",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.x86_64",
          "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-javadoc-4.1.132-150200.4.43.1.noarch",
          "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.aarch64",
          "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.ppc64le",
          "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.s390x",
          "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.x86_64",
          "openSUSE Leap 15.6:netty-javadoc-4.1.132-150200.4.43.1.noarch",
          "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
          "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
          "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.s390x",
          "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
          "openSUSE Leap 15.6:netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-33871",
          "url": "https://www.suse.com/security/cve/CVE-2026-33871"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1261043 for CVE-2026-33871",
          "url": "https://bugzilla.suse.com/1261043"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-javadoc-4.1.132-150200.4.43.1.noarch",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.aarch64",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.ppc64le",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.s390x",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.x86_64",
            "openSUSE Leap 15.6:netty-javadoc-4.1.132-150200.4.43.1.noarch",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.s390x",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
            "openSUSE Leap 15.6:netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.s390x",
            "SUSE Linux Enterprise Module for Development Tools 15 SP7:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.aarch64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.ppc64le",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.s390x",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-4.1.132-150200.4.43.1.x86_64",
            "SUSE Linux Enterprise Module for Package Hub 15 SP7:netty-javadoc-4.1.132-150200.4.43.1.noarch",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.aarch64",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.ppc64le",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.s390x",
            "openSUSE Leap 15.6:netty-4.1.132-150200.4.43.1.x86_64",
            "openSUSE Leap 15.6:netty-javadoc-4.1.132-150200.4.43.1.noarch",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.aarch64",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.ppc64le",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.s390x",
            "openSUSE Leap 15.6:netty-tcnative-2.0.75-150200.3.36.1.x86_64",
            "openSUSE Leap 15.6:netty-tcnative-javadoc-2.0.75-150200.3.36.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-04-15T13:37:19Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-33871"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.