RHSA-2026:50085

Vulnerability from csaf_redhat - Published: 2026-08-04 13:59 - Updated: 2026-08-07 04:53
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release
Severity
Important
Notes
Topic: JBoss EAP XP 6.0.5.1 release on the EAP 8.1 base. See references for release notes.
Details: A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Security Fix(es): * memory exhaustion in io.netty:netty-codec-haproxy (CVE-2026-48059) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-47691) * DDoS in io.netty:netty-codec-http2 (CVE-2026-50560) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-50011) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44250) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44890) * IPv6 subnet filter bypass in io.netty:netty-handler (CVE-2026-44249) * request smuggling in io.netty:netty-codec-http (CVE-2026-50020) * memory leak in io.netty:netty-codec-haproxy (CVE-2026-44893) * TLS hostname verification accidentally disabled in io.netty:netty-handler (CVE-2026-50010) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45673) * excessive memory usage from SNIHandler in io.netty:netty-handler (CVE-2026-45416) * file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue (CVE-2026-45536) * DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45674) * memory exhaustion in io.netty:netty-transport-sctp (CVE-2026-46340) * denial of service in io.netty:netty-codec-http2 (CVE-2026-47244) * memory exhaustion in io.netty:netty-codec-redis (CVE-2026-48006) * memory exhaustion in io.netty:netty-codec-http2 (CVE-2026-48043) * netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-42587

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44249

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44250

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44890

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server's direct memory pool, leading to a Denial of Service (DoS) condition where legitimate connections cannot be processed.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44893

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-805 - Buffer Access with Incorrect Length Value
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-45416

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-45536

A flaw was found in Netty, a network application framework. A local attacker could exploit a vulnerability in the `netty_unix_socket_recvFd` function when handling `SCM_RIGHTS` messages in `Epoll` or `KQueue DomainSocketChannel` with `DomainSocketReadMode.FILE_DESCRIPTORS` enabled. Incorrect handling of file descriptors could lead to a resource leak, resulting in a Denial of Service (DoS) due to exhaustion of available file descriptors.

4.0 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-167 - Improper Handling of Additional Special Element
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-45673

A flaw was found in Netty's DNS resolver component. This vulnerability arises from the use of a predictable pseudo-random number generator (PRNG) for DNS transaction IDs and a static User Datagram Protocol (UDP) source port. This combination significantly reduces the randomness of DNS queries, making it easier for a remote attacker to perform DNS Cache Poisoning, also known as a Kaminsky attack. Successful exploitation could allow an attacker to redirect network traffic to malicious servers.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
CWE-1241 - Use of Predictable Algorithm in Random Number Generator
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-45674

A flaw was found in Netty's DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.

8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-46340

A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol (SCTP) message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service (DoS) condition. The affected component fails to limit the size or number of these fragments, allowing an attacker to consume excessive system resources.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-47244

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a large number of HTTP/2 stream requests to a Netty HTTP/2 server. If the server does not explicitly limit concurrent streams, it can lead to the allocation of numerous long-lived stream objects. This excessive resource consumption can result in a denial of service (DoS), making the server unavailable to legitimate users.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-47691

A flaw was found in Netty's `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.

8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE-346 - Origin Validation Error
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-48006

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-48043

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 - Missing Release of Resource after Effective Lifetime
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-48059

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1286 - Improper Validation of Syntactic Correctness of Input
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-50010

A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-347 - Improper Verification of Cryptographic Signature
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-50011

A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity, leading to excessive memory pre-allocation. This can result in a denial of service (DoS) due to resource exhaustion.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-50020

A flaw was found in Netty. The HttpObjectDecoder component, which processes incoming HTTP requests, incorrectly skips certain control characters and whitespace before reading the first request line. This behavior, which goes beyond standard HTTP protocol requirements, can lead to request-boundary confusion in systems that use pipelined or multiplexed transports. An attacker could exploit this to cause a front-end component to misinterpret HTTP request boundaries, potentially resulting in low integrity impact, such as unintended data manipulation.

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-50560

A flaw was found in Netty, a network application framework. A remote attacker can exploit a vulnerability in the HTTP/2 (Hypertext Transfer Protocol version 2) maximum header size handling. By sending a specific SETTINGS_MAX_HEADER_LIST_SIZE setting, an attacker can cause Netty to produce an exception when writing response headers. This issue is similar to an HTTP/2 Rapid Reset attack and can lead to a Denial of Service (DoS).

5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Red Hat JBoss Enterprise Application Platform 8.1
Red Hat / Red Hat JBoss Enterprise Application Platform
 cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
References
URL Category
https://access.redhat.com/errata/RHSA-2026:50085 self
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://docs.redhat.com/en/documentation/red_hat_… external
https://bugzilla.redhat.com/show_bug.cgi?id=2477220 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488053 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488062 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488081 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488383 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488386 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488388 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488391 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488394 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488399 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488400 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488407 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488413 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488421 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488429 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488433 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488437 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488439 external
https://bugzilla.redhat.com/show_bug.cgi?id=2488442 external
https://issues.redhat.com/browse/JBEAP-33612 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-42587 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477220 external
https://www.cve.org/CVERecord?id=CVE-2026-42587 external
https://nvd.nist.gov/vuln/detail/CVE-2026-42587 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-44249 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488081 external
https://www.cve.org/CVERecord?id=CVE-2026-44249 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44249 external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/releases/tag/netty… external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-44250 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488062 external
https://www.cve.org/CVERecord?id=CVE-2026-44250 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44250 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-44890 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488053 external
https://www.cve.org/CVERecord?id=CVE-2026-44890 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44890 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-44893 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488383 external
https://www.cve.org/CVERecord?id=CVE-2026-44893 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44893 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-45416 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488391 external
https://www.cve.org/CVERecord?id=CVE-2026-45416 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45416 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-45536 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488394 external
https://www.cve.org/CVERecord?id=CVE-2026-45536 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45536 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-45673 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488386 external
https://www.cve.org/CVERecord?id=CVE-2026-45673 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45673 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-45674 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488400 external
https://www.cve.org/CVERecord?id=CVE-2026-45674 external
https://nvd.nist.gov/vuln/detail/CVE-2026-45674 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-46340 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488388 external
https://www.cve.org/CVERecord?id=CVE-2026-46340 external
https://nvd.nist.gov/vuln/detail/CVE-2026-46340 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-47244 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488399 external
https://www.cve.org/CVERecord?id=CVE-2026-47244 external
https://nvd.nist.gov/vuln/detail/CVE-2026-47244 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-47691 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488439 external
https://www.cve.org/CVERecord?id=CVE-2026-47691 external
https://nvd.nist.gov/vuln/detail/CVE-2026-47691 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-48006 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488433 external
https://www.cve.org/CVERecord?id=CVE-2026-48006 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48006 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-48043 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488442 external
https://www.cve.org/CVERecord?id=CVE-2026-48043 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48043 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-48059 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488437 external
https://www.cve.org/CVERecord?id=CVE-2026-48059 external
https://nvd.nist.gov/vuln/detail/CVE-2026-48059 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50010 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488429 external
https://www.cve.org/CVERecord?id=CVE-2026-50010 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50010 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50011 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488413 external
https://www.cve.org/CVERecord?id=CVE-2026-50011 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50011 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50020 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488421 external
https://www.cve.org/CVERecord?id=CVE-2026-50020 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50020 external
https://github.com/netty/netty/security/advisorie… external
https://access.redhat.com/security/cve/CVE-2026-50560 self
https://bugzilla.redhat.com/show_bug.cgi?id=2488407 external
https://www.cve.org/CVERecord?id=CVE-2026-50560 external
https://nvd.nist.gov/vuln/detail/CVE-2026-50560 external
https://github.com/netty/netty/security/advisorie… external
https://www.rfc-editor.org/rfc/rfc9113.html#name-… external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "JBoss EAP XP 6.0.5.1 release on the EAP 8.1 base. See references for release notes.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform 8.1.7.1, XP 6.0.5.1. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.\n\nSecurity Fix(es):\n\n* memory exhaustion in io.netty:netty-codec-haproxy (CVE-2026-48059)\n\n* DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-47691)\n\n* DDoS in io.netty:netty-codec-http2 (CVE-2026-50560)\n\n* memory exhaustion in io.netty:netty-codec-redis (CVE-2026-50011)\n\n* memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44250)\n\n* memory exhaustion in io.netty:netty-codec-redis (CVE-2026-44890)\n\n* IPv6 subnet filter bypass in io.netty:netty-handler (CVE-2026-44249)\n\n* request smuggling in io.netty:netty-codec-http (CVE-2026-50020)\n\n* memory leak in io.netty:netty-codec-haproxy (CVE-2026-44893)\n\n* TLS hostname verification accidentally disabled in io.netty:netty-handler (CVE-2026-50010)\n\n* DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45673)\n\n* excessive memory usage from SNIHandler in io.netty:netty-handler (CVE-2026-45416)\n\n* file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue (CVE-2026-45536)\n\n* DNS cache poisoning in io.netty:netty-resolver-dns (CVE-2026-45674)\n\n* memory exhaustion in io.netty:netty-transport-sctp (CVE-2026-46340)\n\n* denial of service in io.netty:netty-codec-http2 (CVE-2026-47244)\n\n* memory exhaustion in io.netty:netty-codec-redis (CVE-2026-48006)\n\n* memory exhaustion in io.netty:netty-codec-http2 (CVE-2026-48043)\n\n* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:50085",
        "url": "https://access.redhat.com/errata/RHSA-2026:50085"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html-single/red_hat_jboss_eap_xp_6.0_release_notes/index",
        "url": "https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html-single/red_hat_jboss_eap_xp_6.0_release_notes/index"
      },
      {
        "category": "external",
        "summary": "2477220",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
      },
      {
        "category": "external",
        "summary": "2488053",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488053"
      },
      {
        "category": "external",
        "summary": "2488062",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"
      },
      {
        "category": "external",
        "summary": "2488081",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
      },
      {
        "category": "external",
        "summary": "2488383",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
      },
      {
        "category": "external",
        "summary": "2488386",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488386"
      },
      {
        "category": "external",
        "summary": "2488388",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488388"
      },
      {
        "category": "external",
        "summary": "2488391",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
      },
      {
        "category": "external",
        "summary": "2488394",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488394"
      },
      {
        "category": "external",
        "summary": "2488399",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488399"
      },
      {
        "category": "external",
        "summary": "2488400",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488400"
      },
      {
        "category": "external",
        "summary": "2488407",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488407"
      },
      {
        "category": "external",
        "summary": "2488413",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488413"
      },
      {
        "category": "external",
        "summary": "2488421",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488421"
      },
      {
        "category": "external",
        "summary": "2488429",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
      },
      {
        "category": "external",
        "summary": "2488433",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433"
      },
      {
        "category": "external",
        "summary": "2488437",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
      },
      {
        "category": "external",
        "summary": "2488439",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439"
      },
      {
        "category": "external",
        "summary": "2488442",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
      },
      {
        "category": "external",
        "summary": "JBEAP-33612",
        "url": "https://issues.redhat.com/browse/JBEAP-33612"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50085.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.7.1 XP 6.0.5.1 release",
    "tracking": {
      "current_release_date": "2026-08-07T04:53:45+00:00",
      "generator": {
        "date": "2026-08-07T04:53:45+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.12"
        }
      },
      "id": "RHSA-2026:50085",
      "initial_release_date": "2026-08-04T13:59:30+00:00",
      "revision_history": [
        {
          "date": "2026-08-04T13:59:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-04T13:59:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-07T04:53:45+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform 8.1",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform 8.1",
                  "product_id": "Red Hat JBoss Enterprise Application Platform 8.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-42587",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-05-13T19:01:35.415881+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477220"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477220",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
        }
      ],
      "release_date": "2026-05-13T18:22:21.699000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
    },
    {
      "cve": "CVE-2026-44249",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-06-11T22:02:05.327173+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo() function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended network restrictions, potentially leading to unauthorized access or exposure of services.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in netty-handler is rated as Important because a remote attacker can bypass configured IPv6 subnet filtering rules. This flaw, stemming from an incorrect masking operation, could allow unauthorized access to or exposure of services that are intended to be network-restricted within Red Hat products utilizing the affected Netty component.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44249",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86"
        }
      ],
      "release_date": "2026-06-11T20:46:14.110000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation"
    },
    {
      "cve": "CVE-2026-44250",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-11T22:01:16.373607+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488062"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion. Consequently, this can result in a Denial of Service (DoS) condition, rendering the affected server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in netty-codec-redis, affecting Red Hat products that process Redis payloads. A remote attacker can exhaust server memory by sending a crafted Redis payload with deeply nested arrays, leading to an OutOfMemoryError and rendering the service unresponsive. This impact is significant due to the potential for complete service disruption without authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44250"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488062",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488062"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44250",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44250"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44250",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44250"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-3244-j874-rhc2"
        }
      ],
      "release_date": "2026-06-11T20:49:00.487000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services utilizing netty-codec-redis to trusted clients and networks only. Implement firewall rules to limit exposure of the Redis service or the application using it to prevent unauthenticated remote attackers from sending malicious payloads. This may impact legitimate client connections if not configured carefully. A service restart may be required for firewall rule changes to take effect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays"
    },
    {
      "cve": "CVE-2026-44890",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-11T22:00:53.322242+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488053"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending specially crafted Redis payloads across multiple connections without proper termination. This can exhaust the server\u0027s direct memory pool, leading to a Denial of Service (DoS) condition where legitimate connections cannot be processed.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important as it allows a remote, unauthenticated attacker to cause a denial of service in applications utilizing `netty-codec-redis` or `netty-handler`. By sending specially crafted Redis payloads without proper termination, an attacker can exhaust the server\u0027s direct memory pool, preventing legitimate connections and disrupting service availability. This impacts Red Hat products that process Redis traffic via affected Netty components.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44890"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488053",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488053"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44890",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44890"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44890",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44890"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-6ghj-frrj-jjj3"
        }
      ],
      "release_date": "2026-06-11T20:52:50.980000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payloads"
    },
    {
      "cve": "CVE-2026-44893",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "discovery_date": "2026-06-12T15:01:18.066312+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488383"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2_TYPE_SSL TLV (Type-Length-Value) header. This can lead to an IndexOutOfBoundsException and prevent the release of retained memory, ultimately causing a Denial of Service (DoS) condition for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important because a remote, unauthenticated attacker can trigger a denial of service in applications utilizing `netty-codec-haproxy`. By sending a specially crafted HAProxy message with a malformed SSL TLV header, an attacker can cause an `IndexOutOfBoundsException`, leading to unreleased memory and resource exhaustion. This can render the affected application unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44893"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488383",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488383"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44893",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44893"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv"
        }
      ],
      "release_date": "2026-06-12T14:00:25.801000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message"
    },
    {
      "cve": "CVE-2026-45416",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-12T15:01:45.671884+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488391"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Netty is rated as Important. It allows a remote attacker to trigger a denial of service by sending a specially crafted TLS ClientHello message. The flaw arises from an eager, unbounded memory allocation during the TLS handshake, particularly when default configurations disable the maximum client hello length guard, leading to excessive resource consumption in affected Red Hat products utilizing Netty.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488391",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45416",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"
        }
      ],
      "release_date": "2026-06-12T14:10:05.585000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, configure applications utilizing Netty\u0027s `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application\u0027s documentation for details on configuring Netty\u0027s TLS handler. A restart of the affected application or service is required for the configuration changes to take effect.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake"
    },
    {
      "cve": "CVE-2026-45536",
      "cwe": {
        "id": "CWE-167",
        "name": "Improper Handling of Additional Special Element"
      },
      "discovery_date": "2026-06-12T15:01:55.919712+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488394"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A local attacker could exploit a vulnerability in the `netty_unix_socket_recvFd` function when handling `SCM_RIGHTS` messages in `Epoll` or `KQueue DomainSocketChannel` with `DomainSocketReadMode.FILE_DESCRIPTORS` enabled. Incorrect handling of file descriptors could lead to a resource leak, resulting in a Denial of Service (DoS) due to exhaustion of available file descriptors.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Netty can lead to a denial of service due to file descriptor exhaustion. The vulnerability requires a local attacker and is only exploitable when applications explicitly enable `DomainSocketReadMode.FILE_DESCRIPTORS` in `Epoll` or `KQueue DomainSocketChannel`, which is not a default configuration in Red Hat products. This significantly reduces the attack surface to specific, custom deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45536"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488394",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488394"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45536",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45536"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45536",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45536"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-w573-9ffj-6ff9"
        }
      ],
      "release_date": "2026-06-12T14:12:48.126000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, ensure that `DomainSocketReadMode.FILE_DESCRIPTORS` is not enabled in applications utilizing Netty\u0027s `Epoll` or `KQueue DomainSocketChannel`. This feature is not enabled by default, and disabling it prevents the file descriptor leak that could lead to a Denial of Service.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling"
    },
    {
      "cve": "CVE-2026-45673",
      "cwe": {
        "id": "CWE-1241",
        "name": "Use of Predictable Algorithm in Random Number Generator"
      },
      "discovery_date": "2026-06-12T15:01:28.171757+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488386"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s DNS resolver component. This vulnerability arises from the use of a predictable pseudo-random number generator (PRNG) for DNS transaction IDs and a static User Datagram Protocol (UDP) source port. This combination significantly reduces the randomness of DNS queries, making it easier for a remote attacker to perform DNS Cache Poisoning, also known as a Kaminsky attack. Successful exploitation could allow an attacker to redirect network traffic to malicious servers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: This flaw in Netty\u0027s DNS resolver could allow a remote attacker to perform DNS cache poisoning. The vulnerability stems from the use of a predictable pseudo-random number generator for DNS transaction IDs and a static UDP source port, which reduces the entropy of DNS queries. This makes it easier for an attacker to redirect network traffic to malicious servers, potentially leading to traffic interception or Man-in-the-Middle attacks for applications using the default Netty DNS resolver in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45673"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488386",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488386"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45673",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45673"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45673",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45673"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-xmv7-r254-6q78"
        }
      ],
      "release_date": "2026-06-12T14:16:03.968000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs"
    },
    {
      "cve": "CVE-2026-45674",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-06-12T15:02:15.565158+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488400"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s DnsResolveContext. This vulnerability allows a remote attacker to achieve information disclosure or data manipulation by crafting malicious DNS responses. The flaw occurs because the DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses, which could enable an attacker to redirect network traffic or intercept sensitive data from affected applications.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important severity flaw in Netty\u0027s DnsResolveContext allows a remote attacker to achieve information disclosure or data manipulation. By crafting malicious DNS responses, an attacker could redirect network traffic or intercept sensitive data, impacting applications utilizing Netty for DNS resolution in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45674"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488400",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488400"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45674",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45674"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-676x-f7gg-47vc"
        }
      ],
      "release_date": "2026-06-12T14:17:50.203000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation"
    },
    {
      "cve": "CVE-2026-46340",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-12T15:01:34.090215+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488388"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-transport-sctp. A remote attacker can exploit this vulnerability by sending specially crafted, non-complete Stream Control Transmission Protocol (SCTP) message fragments. This can lead to unbounded memory growth within the application, causing a Denial of Service (DoS) condition. The affected component fails to limit the size or number of these fragments, allowing an attacker to consume excessive system resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw exists in `netty-transport-sctp`, a component used across various Red Hat products. A remote, unauthenticated attacker can exploit this vulnerability by sending fragmented Stream Control Transmission Protocol (SCTP) messages without the completion flag. This leads to unbounded memory growth and resource exhaustion, causing a complete denial of service for applications utilizing the affected Netty component.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46340"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488388",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488388"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46340",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46340"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46340",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46340"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5xrh-qmmq-w6ch"
        }
      ],
      "release_date": "2026-06-12T14:19:48.855000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-transport-sctp: Netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments"
    },
    {
      "cve": "CVE-2026-47244",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-12T15:02:11.516632+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488399"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a large number of HTTP/2 stream requests to a Netty HTTP/2 server. If the server does not explicitly limit concurrent streams, it can lead to the allocation of numerous long-lived stream objects. This excessive resource consumption can result in a denial of service (DoS), making the server unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in Netty\u0027s HTTP/2 implementation can lead to a denial of service in Red Hat products that utilize Netty as an HTTP/2 server without explicitly configured limits on concurrent streams. An attacker can exhaust server resources by initiating numerous HTTP/2 stream requests, rendering the service unavailable. The impact is limited to denial of service and requires a specific server configuration to be exploitable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47244"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488399",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488399"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47244",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47244"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47244",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47244"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q"
        }
      ],
      "release_date": "2026-06-12T14:23:50.316000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Configure affected applications using Netty HTTP/2 servers to explicitly set a maximum concurrent streams limit. Consult product-specific documentation for instructions on how to apply this configuration. Additionally, restrict network access to affected services to trusted clients and networks by implementing firewall rules or other network access controls. This may impact legitimate traffic if not carefully configured.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams"
    },
    {
      "cve": "CVE-2026-47691",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "discovery_date": "2026-06-12T16:02:45.855856+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488439"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty\u0027s `DnsResolveContext`. An attacker controlling an authoritative name server for a subdomain can exploit this vulnerability by providing crafted NS records that are insufficiently validated. This allows the attacker to poison the DNS cache for parent domains, bypassing standard bailiwick rules. Consequently, future DNS resolutions for the affected parent domain will use the poisoned cache, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important flaw in Netty\u0027s DNS resolution component, `netty-resolver-dns`, allows for DNS cache poisoning. An attacker with control over an authoritative name server for a subdomain could exploit this vulnerability to inject malicious DNS records into the cache of parent domains. This could lead to redirection of network traffic, impacting the integrity and availability of services relying on DNS resolution within affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-47691"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488439",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488439"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-47691",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-47691"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85"
        }
      ],
      "release_date": "2026-06-12T14:33:16.595000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records"
    },
    {
      "cve": "CVE-2026-48006",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-06-12T16:02:27.195680+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488433"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by repeatedly closing Redis pipeline connections before a Redis array aggregate completes. This leads to a permanent leak of direct-memory buffers, which prevents memory chunks from being returned to the shared memory pool. Over time, this can exhaust the available memory, causing a Denial of Service (DoS) for all Netty channels in the process.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-redis: Netty\u0027s Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s RedisArrayAggregator. Repeated connection churn by a network peer can lead to a permanent leak of direct-memory buffers, eventually exhausting the JVM-wide direct-memory pool. This can cause allocation failures across all Netty channels, impacting the availability and stability of Red Hat products utilizing Netty for Redis communication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48006"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488433",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488433"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48006",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48006"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48006",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48006"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-6jv9-x5w9-2ccm"
        }
      ],
      "release_date": "2026-06-12T14:36:44.416000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-redis: Netty\u0027s Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator"
    },
    {
      "cve": "CVE-2026-48043",
      "cwe": {
        "id": "CWE-772",
        "name": "Missing Release of Resource after Effective Lifetime"
      },
      "discovery_date": "2026-06-12T16:02:56.371830+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488442"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the `DelegatingDecompressorFrameListener` class. This resource leak could lead to an Out Of Memory Error (OOME), potentially causing a Denial of Service (DoS) by taking down the entire Java Virtual Machine (JVM).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in netty-codec-http2, affecting Red Hat products that utilize HTTP/2 communication with decompression. A remote attacker can exploit a resource leak in the `DelegatingDecompressorFrameListener` by sending malformed HTTP/2 frames, potentially leading to an Out Of Memory Error and causing the Java Virtual Machine to terminate. This could disrupt service availability in affected deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48043"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488442",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488442"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48043",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48043"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j"
        }
      ],
      "release_date": "2026-06-12T14:39:52.498000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak"
    },
    {
      "cve": "CVE-2026-48059",
      "cwe": {
        "id": "CWE-1286",
        "name": "Improper Validation of Syntactic Correctness of Input"
      },
      "discovery_date": "2026-06-12T16:02:40.032749+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488437"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested `PP2_TYPE_SSL` type-length-value (TLV) records. This can lead to a memory leak, causing the underlying cumulation buffer to remain permanently pinned and potentially resulting in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in the Netty HAProxy PROXY protocol v2 codec, which can lead to a denial of service. A remote attacker can trigger a memory leak by sending a specially crafted HAProxy PROXY protocol v2 header with deeply nested SSL TLV records, causing resource exhaustion in affected Red Hat products that utilize this codec.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48059"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488437",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48059",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48059"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j"
        }
      ],
      "release_date": "2026-06-12T14:42:44.677000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers"
    },
    {
      "cve": "CVE-2026-50010",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2026-06-12T16:02:13.735675+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488429"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. This vulnerability allows a remote attacker to bypass hostname verification due to improper handling of user-supplied trust managers. When a client is configured with a plain X.509 Trust Manager (X509TrustManager), it fails to perform necessary hostname checks, enabling an attacker to impersonate a legitimate server. This could lead to sensitive information disclosure or man-in-the-middle attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in Netty that affects Red Hat products utilizing the `netty-handler` component, including various Red Hat AMQ, Enterprise Application Platform, and OpenShift offerings. The vulnerability arises when a Netty client is configured with a plain X.509 Trust Manager, leading to a bypass of hostname verification. This oversight allows a remote attacker to perform man-in-the-middle attacks by impersonating a legitimate server, potentially compromising sensitive data.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488429",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488429"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50010",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9"
        }
      ],
      "release_date": "2026-06-12T14:50:43.151000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass"
    },
    {
      "cve": "CVE-2026-50011",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-12T16:01:17.003045+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488413"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. The RedisArrayAggregator component pre-allocates memory based on the declared element count in a Redis array header. A remote attacker can exploit this by sending a small, malicious Redis array header that claims a huge initial capacity, leading to excessive memory pre-allocation. This can result in a denial of service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-redis: Netty: Denial of Service via malicious Redis array header",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in Netty\u0027s RedisArrayAggregator component. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted Redis array header, causing excessive memory pre-allocation and leading to resource exhaustion. This can disrupt services utilizing Netty for Redis communication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50011"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488413",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488413"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50011",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50011"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50011",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50011"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-5w86-c3rq-vjj7"
        }
      ],
      "release_date": "2026-06-12T14:52:18.042000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, restrict network access to services that utilize the netty-codec-redis component and process Redis traffic. Configure firewalls or network access control lists (ACLs) to limit connections to these services from trusted networks or localhost only. This reduces the attack surface by preventing untrusted remote attackers from sending malicious Redis array headers. Consult product-specific documentation for detailed instructions on configuring network access for affected Red Hat products. Reloading or restarting services may be required for network configuration changes to take effect, which could temporarily impact availability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "netty-codec-redis: Netty: Denial of Service via malicious Redis array header"
    },
    {
      "cve": "CVE-2026-50020",
      "cwe": {
        "id": "CWE-444",
        "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
      },
      "discovery_date": "2026-06-12T16:01:51.804290+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488421"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty. The HttpObjectDecoder component, which processes incoming HTTP requests, incorrectly skips certain control characters and whitespace before reading the first request line. This behavior, which goes beyond standard HTTP protocol requirements, can lead to request-boundary confusion in systems that use pipelined or multiplexed transports. An attacker could exploit this to cause a front-end component to misinterpret HTTP request boundaries, potentially resulting in low integrity impact, such as unintended data manipulation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate flaw in Netty\u0027s HttpObjectDecoder could lead to data manipulation in Red Hat products utilizing pipelined or multiplexed HTTP transports. The vulnerability arises from the decoder\u0027s over-permissive handling of control characters and whitespace, which can cause front-end components to misinterpret HTTP request boundaries. Exploitation requires a specific network configuration where front-end and back-end components process HTTP requests inconsistently, limiting the immediate impact on default installations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50020"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488421",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488421"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50020",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50020"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50020",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50020"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-hvcg-qmg6-jm4c"
        }
      ],
      "release_date": "2026-06-12T14:55:32.165000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder"
    },
    {
      "cve": "CVE-2026-50560",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-12T16:00:59.240952+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2488407"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Netty, a network application framework. A remote attacker can exploit a vulnerability in the HTTP/2 (Hypertext Transfer Protocol version 2) maximum header size handling. By sending a specific SETTINGS_MAX_HEADER_LIST_SIZE setting, an attacker can cause Netty to produce an exception when writing response headers. This issue is similar to an HTTP/2 Rapid Reset attack and can lead to a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in Netty\u0027s HTTP/2 protocol handling is rated Moderate. A remote, unauthenticated attacker can trigger a denial of service by sending a crafted `SETTINGS_MAX_HEADER_LIST_SIZE` frame, causing an exception during response header processing. This can disrupt services utilizing Netty for HTTP/2 communication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform 8.1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-50560"
        },
        {
          "category": "external",
          "summary": "RHBZ#2488407",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488407"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-50560",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-50560"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50560",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50560"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
          "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"
        },
        {
          "category": "external",
          "summary": "https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm",
          "url": "https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm"
        },
        {
          "category": "external",
          "summary": "https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings",
          "url": "https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings"
        }
      ],
      "release_date": "2026-06-12T14:59:59.901000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-04T13:59:30+00:00",
          "details": "Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:50085"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform 8.1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.