RHSA-2026:83612
Vulnerability from csaf_redhat - Published: 2026-10-15 14:45 - Updated: 2026-10-20 11:22Summary
Red Hat Security Advisory: Red Hat build of Debezium 3.6.3 release
Severity
Important
Notes
Topic: Red Hat build of Debezium connectors in version 3.6.3 are now available for Red Hat Application Foundations.
Details: Debezium is a distributed platform that turns your existing databases into event streams, so applications can see and respond immediately to each row-level change in the databases.
Debezium is built on top of Apache Kafka and provides Kafka Connect compatible connectors that monitor specific database management systems. Debezium records the history of data changes in Kafka logs, from where your application consumes them. This makes it possible for your application to easily consume all of the events correctly and completely. Even if your application stops unexpectedly, it will not miss anything: when the application restarts, it will resume consuming the events where it left off.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty's hash computation for passwords does not correctly handle certain characters, leading to a weakness in how passwords are processed. A remote attacker could exploit this by crafting a specific password that generates the same internal hash as a legitimate user's password, thereby bypassing authentication and gaining unauthorized access to the victim's account.
9.1 (Critical)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat Build of Debezium 3.6
Red Hat / Red Hat Integration
|
cpe:/a:redhat:debezium:3.6
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous and current request trailers.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in org.mongodb/mongodb-driver. During routine client initialization, sensitive configuration information, including credentials for outbound network connectivity, is written to application log output in cleartext. A local attacker with the ability to read the affected application's logs or downstream log-aggregation storage could recover these credentials. This allows them to reuse the credentials to authenticate to the associated network infrastructure, leading to information disclosure.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger vulnerable JDBC drivers. This requires specific conditions, including the presence of a susceptible JDBC driver and a mechanism for automatic property resolution during deserialization.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Micrometer's StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary metrics, including critical system or business metrics, and the injection of false log entries, potentially impacting monitoring and auditing systems.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security (TLS) hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can impersonate the server, leading to a Man-in-the-Middle (MITM) attack and compromising communication.
8.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually leading to a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Apache ZooKeeper. The deleteContainer opcode is processed without verifying Access Control List (ACL) permissions. A remote, unauthenticated attacker with network access to the ZooKeeper client port can delete any empty persistent znode, including container and TTL nodes. This can lead to data integrity issues or denial of service.
9.1 (Critical)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Deep Java Library. Due to an integer overflow during tensor buffer validation, a remote, unauthenticated attacker can send a crafted tensor payload to trigger out-of-bounds memory access. Successful exploitation can allow an attacker to obtain sensitive data from adjacent process memory or crash the application, resulting in a Denial of Service (DoS).
7.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.
8.2 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Moderate
A flaw was found in Netty. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by exhausting server memory. Because the SPDY session handler does not restrict the number of concurrent streams initiated by a remote peer, an attacker can transmit an excessive volume of stream creation requests over a connection, triggering memory exhaustion and crashing the application.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending numerous pipelined HTTP/1.1 requests over a single connection while withholding reads. Netty's HTTP server codec stores unanswered requests in an internal queue without a size limit, leading to excessive memory consumption and an eventual application crash.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
A flaw was found in Netty's HttpServerCodec. A remote attacker can exploit this vulnerability to cause HTTP response desynchronization, leading to response splitting and potential information disclosure. By sending pipelined requests with informational headers followed by another request, the server misaligns outbound responses with queued inbound requests. Consequently, response data can be associated with the wrong request on reused connections, leading to the delivery of unintended content.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-10050
Threats
Impact
Important
References
166 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat build of Debezium connectors in version 3.6.3 are now available for Red Hat Application Foundations.",
"title": "Topic"
},
{
"category": "general",
"text": "Debezium is a distributed platform that turns your existing databases into event streams, so applications can see and respond immediately to each row-level change in the databases.\n\nDebezium is built on top of Apache Kafka and provides Kafka Connect compatible connectors that monitor specific database management systems. Debezium records the history of data changes in Kafka logs, from where your application consumes them. This makes it possible for your application to easily consume all of the events correctly and completely. Even if your application stops unexpectedly, it will not miss anything: when the application restarts, it will resume consuming the events where it left off.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:83612",
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83612.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Debezium 3.6.3 release",
"tracking": {
"current_release_date": "2026-10-20T11:22:02+00:00",
"generator": {
"date": "2026-10-20T11:22:02+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.2"
}
},
"id": "RHSA-2026:83612",
"initial_release_date": "2026-10-15T14:45:59+00:00",
"revision_history": [
{
"date": "2026-10-15T14:45:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-15T14:45:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-20T11:22:02+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Build of Debezium 3.6",
"product": {
"name": "Red Hat Build of Debezium 3.6",
"product_id": "Red Hat Build of Debezium 3.6",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:debezium:3.6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Integration"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-10050",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-07-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510732"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty, a widely used web server and servlet container. This vulnerability affects its HTTP Digest authentication mechanism, which is used to verify user identities. The issue arises because Jetty\u0027s hash computation for passwords does not correctly handle certain characters, leading to a weakness in how passwords are processed. A remote attacker could exploit this by crafting a specific password that generates the same internal hash as a legitimate user\u0027s password, thereby bypassing authentication and gaining unauthorized access to the victim\u0027s account.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw allows an authentication bypass in Eclipse Jetty\u0027s HTTP Digest authentication. An attacker who knows a victim\u0027s username can craft a collision password if the original password contains non-Latin-1 characters, leading to unauthorized access in affected Red Hat products that utilize this authentication method.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10050"
},
{
"category": "external",
"summary": "RHBZ#2510732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510732"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10050",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10050"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10050",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10050"
}
],
"release_date": "2026-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that all user passwords configured for HTTP Digest authentication in affected Eclipse Jetty deployments exclusively use characters within the Latin-1 character set. This prevents the character encoding collision that leads to authentication bypass.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jetty-security: Eclipse Jetty: Authentication bypass via Digest authentication encoding collision"
},
{
"cve": "CVE-2026-10051",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-07-14T10:01:09.470495+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499928"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous and current request trailers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: This information disclosure flaw in Eclipse Jetty allows HTTP/1.1 trailers from a previous request to be retained and subsequently exposed to other requests sharing the same connection. This could lead to unintended disclosure of sensitive information in Red Hat products utilizing Jetty, such as Red Hat AMQ and Enterprise Application Platform, particularly when connection reuse is active and trailers contain confidential data. The confidentiality impact is considered low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-10051"
},
{
"category": "external",
"summary": "RHBZ#2499928",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499928"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-10051",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-10051"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10051",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10051"
},
{
"category": "external",
"summary": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119"
}
],
"release_date": "2026-07-14T08:44:38.233000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections"
},
{
"cve": "CVE-2026-18710",
"cwe": {
"id": "CWE-312",
"name": "Cleartext Storage of Sensitive Information"
},
"discovery_date": "2026-08-11T22:11:27.816772+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514429"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in org.mongodb/mongodb-driver. During routine client initialization, sensitive configuration information, including credentials for outbound network connectivity, is written to application log output in cleartext. A local attacker with the ability to read the affected application\u0027s logs or downstream log-aggregation storage could recover these credentials. This allows them to reuse the credentials to authenticate to the associated network infrastructure, leading to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has Moderate impact. A flaw in MongoDB driver components used by Red Hat products can lead to sensitive credential disclosure. During client initialization, credentials for outbound network connectivity are automatically written in cleartext to application logs. An attacker with local access to these logs could recover and reuse the credentials, compromising confidentiality.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18710"
},
{
"category": "external",
"summary": "RHBZ#2514429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514429"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18710",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18710"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18710",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18710"
},
{
"category": "external",
"summary": "https://jira.mongodb.org/browse/JAVA-6266",
"url": "https://jira.mongodb.org/browse/JAVA-6266"
}
],
"release_date": "2026-08-11T22:00:07.172000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that access to application logs and any downstream log aggregation storage is strictly controlled. Implement robust access control mechanisms to prevent unauthorized parties from reading log output, as this is where sensitive credentials may be exposed in cleartext during MongoDB driver client initialization. Regularly review and audit log access permissions.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "org.mongodb/mongodb-driver: MongoDB Driver: Credential disclosure via cleartext logging during client initialization"
},
{
"acknowledgments": [
{
"names": [
"LiuBo-keep (aidan)"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2026-19611",
"cwe": {
"id": "CWE-173",
"name": "Improper Handling of Alternate Encoding"
},
"discovery_date": "2026-07-24T14:34:50+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514568"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords were intended to include those non-ASCII characters, leading to unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue has Moderate impact. Successful exploitation depends on accounts using fullwidth or other NFKC-compatibility characters in passwords and on the feasibility of password guessing against the deployed hash algorithm. Red Hat products that ship org.wildfly.security:wildfly-elytron-password-impl may be affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19611"
},
{
"category": "external",
"summary": "RHBZ#2514568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514568"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19611",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19611"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19611"
}
],
"release_date": "2026-07-24T14:34:50+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: Password keyspace reduction via NFKC fullwidth folding"
},
{
"cve": "CVE-2026-55223",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2026-07-01T00:17:48.138580+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2495798"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger vulnerable JDBC drivers. This requires specific conditions, including the presence of a susceptible JDBC driver and a mechanism for automatic property resolution during deserialization.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "c3p0: c3p0: Remote code execution via deserialization vulnerability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in c3p0. Prior to version 0.14.0, c3p0\u0027s DataSource and ConnectionPoolDataSource implementations expose getConnection() and getPooledConnection() as JavaBean properties. During deserialization, carrier libraries such as Apache Commons BeanUtils automatically invoke these getters, which can trigger calls into JDBC drivers. An attacker who can deliver a crafted serialized object to an application could exploit this to achieve remote code execution.\n\nSuccessful exploitation requires all of the following prerequisites to be met:\n1. c3p0 \u003c 0.14.0 on the application classpath\n2. A vulnerable JDBC driver on the classpath\n3. A carrier library that auto-reads JavaBean properties during deserialization (e.g., commons-beanutils with a Comparator in a sorted collection)\n4. A deserialization entry point that processes attacker-controlled data (e.g., via RMI, JMX, or HTTP)\n\nThis is a gadget chain attack where c3p0 provides one essential component. Removing any single prerequisite from the classpath prevents exploitation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55223"
},
{
"category": "external",
"summary": "RHBZ#2495798",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495798"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55223",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55223"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55223",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55223"
},
{
"category": "external",
"summary": "https://github.com/swaldman/c3p0/commit/7b022c4b6694dabc6204254dc917af9c38f2cb27",
"url": "https://github.com/swaldman/c3p0/commit/7b022c4b6694dabc6204254dc917af9c38f2cb27"
},
{
"category": "external",
"summary": "https://github.com/swaldman/c3p0/security/advisories/GHSA-w6w4-rjh9-9r58",
"url": "https://github.com/swaldman/c3p0/security/advisories/GHSA-w6w4-rjh9-9r58"
}
],
"release_date": "2026-06-30T22:56:55.895000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Any of the following can reduce the risk or render exploitation not-feasible:\n- Run applications on Java 16 or later, which restricts reflective access and partially blocks the JavaBean property lookup step of the attack chain.\n- Remove Apache Commons BeanUtils from the classpath if it is not required, eliminating the most common deserialization carrier.\n- Ensure the application does not deserialize untrusted input from network sources.\n\nRed Hat recommends updating c3p0 to version 0.14.0 or later when a fix is available, which adds explicit BeanInfo classes to exclude the dangerous properties from JavaBean introspection.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "c3p0: c3p0: Remote code execution via deserialization vulnerability"
},
{
"cve": "CVE-2026-59296",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-08-21T10:50:55.231408+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520949"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Micrometer\u0027s StatsD and Logging meter registries. This vulnerability allows a remote attacker to inject line terminators into metric data, such as names or tag values, due to insufficient sanitization of untrusted input. Exploitation can lead to the spoofing of arbitrary metrics, including critical system or business metrics, and the injection of false log entries, potentially impacting monitoring and auditing systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A moderate severity flaw was found in Micrometer\u0027s StatsD and Logging meter registries (io.micrometer:micrometer-registry-statsd and io.micrometer:micrometer-core), which are shipped in a number of Red Hat middleware, integration, and application-platform products. These libraries do not sanitize newline characters (\\n, \\r) by default. When an application instruments meters using user-controlled, unvalidated input for metric names, tag keys, or tag values, a remote attacker can inject line terminators to break out of the current metric or log line. With the Datadog or Etsy flavor of the StatsD registry, whose protocol is newline-delimited, this enables line-protocol injection and cross-metric spoofing; with LoggingMeterRegistry, which prints metric output line-by-line to log files, this enables metric spoofing via downstream log-metrics scrapers or parsers as well as general log spoofing. A successful attacker can spoof arbitrary metrics, including critical system or business metrics, and inject false log entries, impacting the integrity of monitoring and auditing systems; the confidentiality and availability of the application itself are not directly affected. Exploitation requires the specific registry configuration together with unsafe instrumentation that passes untrusted input to meters, so attack complexity is high, and Red Hat rates this flaw Moderate (CVSS 3.1: 5.9, AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N), consistent with the upstream MEDIUM rating.\n\nMultiple Red Hat products that ship the affected components, including Red Hat build of Quarkus, JBoss EAP XP, Red Hat Build of Keycloak, JBoss Data Grid, Red Hat AMQ, Red Hat OpenShift AI, and Red Hat build of Apache Camel, are recorded as affected, and fixes are being pursued by the responsible engineering teams; several affected product streams are out of active support scope. Red Hat Satellite is not affected because the vulnerable code is not present in the shipped candlepin component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59296"
},
{
"category": "external",
"summary": "RHBZ#2520949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520949"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59296",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59296"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59296",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59296"
},
{
"category": "external",
"summary": "https://spring.io/security/cve-2026-59296",
"url": "https://spring.io/security/cve-2026-59296"
}
],
"release_date": "2026-08-21T10:47:25.384000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.micrometer/micrometer-registry-statsd: io.micrometer/micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing"
},
{
"cve": "CVE-2026-62243",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-22T12:51:41.376413+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2521309"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty (io.netty:netty-handler). When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping (Java 25+), TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a fraudulent certificate for a different hostname, which is then accepted without proper validation. This could lead to sensitive information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products ship io.netty:netty-handler as a transitive dependency across multiple middleware and platform products. While the CVSS score reflects the severity of a successful exploit \u2014 full confidentiality compromise of TLS-protected traffic without authentication \u2014 the vulnerable code path requires three conditions simultaneously: explicit OpenSSL provider configuration, a plain X509TrustManager, and a Java 25+ runtime. Most Red Hat product deployments use the default JDK SSL provider and currently run on Java 21 LTS, making the vulnerable configuration uncommon in practice.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-62243"
},
{
"category": "external",
"summary": "RHBZ#2521309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-62243",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-62243"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62243"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c",
"url": "https://github.com/netty/netty/security/advisories/GHSA-p85m-gvr3-788c"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass",
"url": "https://www.vulncheck.com/advisories/netty-through-tls-hostname-verification-bypass"
}
],
"release_date": "2026-08-22T12:26:43.072000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "This vulnerability only affects applications that explicitly configure Netty to use the OpenSSL TLS provider (SslProvider.OPENSSL). \n\nThe following mitigations can reduce exposure without applying a patch:\n\n1) Use the default JDK SSL provider \u2014 Do not configure SslProvider.OPENSSL in your Netty SslContext setup. The default JDK SSL provider (SslProvider.JDK) is not affected by this vulnerability. Most applications use the JDK default unless explicitly overridden.\n\n2) Use X509ExtendedTrustManager \u2014 If the OpenSSL provider is required, ensure the configured trust manager extends X509ExtendedTrustManager rather than the plain X509TrustManager interface. The extended variant performs hostname verification independently of the Netty wrapping logic.\n\n3) Run on Java 24 or earlier \u2014 The vulnerable code path only triggers on Java 25+ where sun.misc.Unsafe-based trust-manager wrapping is unavailable. Running on earlier Java versions (e.g., Java 21 LTS) means the wrapping works correctly and hostname verification stays enabled.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration"
},
{
"cve": "CVE-2026-64607",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-07-31T11:00:52.326465+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2509736"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache HttpComponents Client, specifically in its classic input/output (I/O) model. When processing a response message with an invalid or unsupported `Content-Encoding` header, the client fails to properly release the underlying network connection. This connection leak can lead to the exhaustion of the connection pool, making the service unavailable and resulting in a Denial of Service (DoS) for legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Apache HttpComponents Client\u0027s classic I/O model, where an invalid `Content-Encoding` header in a response can prevent proper connection release. This connection leak can exhaust the connection pool, leading to a denial of service for applications utilizing the affected client. The vulnerability does not impact the asynchronous I/O model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64607"
},
{
"category": "external",
"summary": "RHBZ#2509736",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2509736"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64607"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q",
"url": "https://lists.apache.org/thread/qqfzo3fqcdk4l5496vz95ppvl4ty511q"
}
],
"release_date": "2026-07-31T10:12:18.035000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak"
},
{
"cve": "CVE-2026-68494",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-04T15:01:53.631865+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511026"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This uncontrolled memory growth can lead to a denial of service (DoS) by exhausting the Java Virtual Machine (JVM) heap.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in `jackson-core`\u0027s asynchronous JSON parser. A remote, unauthenticated attacker can exploit an incomplete fix to bypass number length constraints, leading to unbounded memory accumulation and potential JVM heap exhaustion in reactive frameworks processing chunked JSON input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68494"
},
{
"category": "external",
"summary": "RHBZ#2511026",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511026"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68494",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68494"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68494"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd",
"url": "https://github.com/FasterXML/jackson-core/commit/050b429804dce2a7e08f0be1b0b4c3d040fdb9cd"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641",
"url": "https://github.com/FasterXML/jackson-core/commit/4cdd529749da396cc7edf6d4a2aad41d47902641"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8",
"url": "https://github.com/FasterXML/jackson-core/commit/c5941e5aae7fd5aeac55d66933cfb82b9aabeef8"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/pull/1611",
"url": "https://github.com/FasterXML/jackson-core/pull/1611"
},
{
"category": "external",
"summary": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9",
"url": "https://github.com/FasterXML/jackson-core/security/advisories/GHSA-r7wm-3cxj-wff9"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-72hv-8253-57qq",
"url": "https://github.com/advisories/GHSA-72hv-8253-57qq"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18401",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18401"
}
],
"release_date": "2026-08-04T14:39:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Upgrade com.fasterxml.jackson.core:jackson-core to a fixed version, such as 2.18.8 or later, 2.21.4 or later, or the first fixed release in the applicable 2.22.x stream. For Jackson 3.x, upgrade to 3.1.4 or later, or the first fixed release in the applicable 3.2.x stream. If upgrading is not immediately possible, do not expose the non-blocking parser to untrusted, incrementally streamed JSON. Where feasible, use a synchronous parser or buffer and enforce strict request-size, connection-timeout, and concurrency limits at the ingress layer. Apply the upgrade as soon as possible because ingress limits reduce exposure but do not correct the parser defect.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser"
},
{
"cve": "CVE-2026-71290",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-08-11T20:51:00.503596+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514394"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security (TLS) hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can impersonate the server, leading to a Man-in-the-Middle (MITM) attack and compromising communication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important as it allows for server impersonation in Red Hat products utilizing the asynchronous Apache HttpComponents Client. An attacker positioned to intercept and alter network traffic can present a fraudulent server certificate, bypassing TLS hostname verification and potentially leading to man-in-the-middle attacks. This flaw does not affect the classic version of HttpClient.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-71290"
},
{
"category": "external",
"summary": "RHBZ#2514394",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514394"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-71290",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-71290"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71290",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71290"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq",
"url": "https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq"
}
],
"release_date": "2026-08-11T20:33:56.947000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Server impersonation via improper TLS hostname verification"
},
{
"cve": "CVE-2026-73508",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"discovery_date": "2026-08-13T15:11:47.778030+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515377"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous network application framework. When processing malformed domain names in DNS packets, the DNS record decoder fails to release allocated memory. This vulnerability allows an unauthenticated remote attacker to incrementally leak direct memory, eventually leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated Important because the affected component fails to release allocated memory when it rejects a malformed domain name during DNS record decoding. An unauthenticated remote attacker who can send DNS traffic to an application using the affected DNS resolution functionality can incrementally exhaust available memory until the process becomes unresponsive, resulting in a complete denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73508"
},
{
"category": "external",
"summary": "RHBZ#2515377",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515377"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73508",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73508"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73508",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73508"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b",
"url": "https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6",
"url": "https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-mfg7-5gfp-c4w3"
}
],
"release_date": "2026-08-13T14:27:20.298000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Red Hat recommends upgrading to a fixed version as the primary remediation. Where an immediate upgrade is not possible, restrict network access so that only trusted DNS servers and trusted network peers can send DNS traffic to the affected application, using firewall or network policy rules to block or rate-limit DNS traffic from untrusted sources. This reduces exposure to the malformed DNS records that trigger the issue but does not fully eliminate it; upgrading remains the only complete fix.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names"
},
{
"cve": "CVE-2026-75595",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"discovery_date": "2026-08-19T21:20:58.535091+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2519953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. An unauthenticated remote attacker can exploit fragmented Transport Layer Security (TLS) ClientHello messages to bypass the Server Name Indication (SNI) routing mechanism. This forces a fallback to a less secure default SslContext, allowing the attacker to bypass mutual TLS authentication requirements and gain unauthorized access to protected resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Netty that allows an unauthenticated remote attacker to bypass mutual TLS authentication. Applications that use Netty and rely solely on SNI-based clientAuth=REQUIRE for access control, without additional application-layer certificate verification, are vulnerable when an attacker exploits fragmented TLS ClientHello messages to force a fallback to a less secure default SslContext. Deployments that enforce clientAuth=REQUIRE uniformly across all SslContexts, or that perform secondary certificate verification at the application layer, are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-75595"
},
{
"category": "external",
"summary": "RHBZ#2519953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2519953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-75595",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-75595"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75595"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7",
"url": "https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961",
"url": "https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17213",
"url": "https://github.com/netty/netty/pull/17213"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/pull/17217",
"url": "https://github.com/netty/netty/pull/17217"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.137.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.17.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5",
"url": "https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5"
}
],
"release_date": "2026-08-19T21:00:27.627000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that application-layer certificate verification is implemented for services utilizing Netty with mutual TLS. This provides an additional layer of authentication beyond the TLS handshake, preventing unauthorized access even if the SNI routing is bypassed and a less restrictive default SslContext is used.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext"
},
{
"cve": "CVE-2026-79993",
"cwe": {
"id": "CWE-425",
"name": "Direct Request (\u0027Forced Browsing\u0027)"
},
"discovery_date": "2026-09-16T09:41:32.337986+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535095"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache ZooKeeper. The deleteContainer opcode is processed without verifying Access Control List (ACL) permissions. A remote, unauthenticated attacker with network access to the ZooKeeper client port can delete any empty persistent znode, including container and TTL nodes. This can lead to data integrity issues or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects Apache ZooKeeper server instances that accept client connections. Red Hat products that ship ZooKeeper may be affected when a server in the vulnerable version range is deployed and reachable on the client port. No authentication is required to exploit this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-79993"
},
{
"category": "external",
"summary": "RHBZ#2535095",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535095"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-79993",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79993"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-79993",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79993"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5",
"url": "https://lists.apache.org/thread/9cw3rmrzhqpct26v8j18fy41bghlq8y5"
}
],
"release_date": "2026-09-16T09:27:22.516000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "zookeeper: Apache ZooKeeper: Unauthorized znode deletion via missing ACL check"
},
{
"cve": "CVE-2026-85228",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-10T17:11:26.806603+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531559"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Deep Java Library. Due to an integer overflow during tensor buffer validation, a remote, unauthenticated attacker can send a crafted tensor payload to trigger out-of-bounds memory access. Successful exploitation can allow an attacker to obtain sensitive data from adjacent process memory or crash the application, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ai.djl/api: Integer overflow in tensor buffer validation in Deep Java Library",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates the impact of this issue as IMPORTANT. An integer overflow in the tensor buffer validation of the Deep Java Library (DJL) allows a remote, unauthenticated attacker to trigger an out-of-bounds memory read by sending a crafted tensor payload. Successful exploitation can disclose sensitive information from adjacent process memory or crash the application, resulting in a denial of service. The ai.djl/api and ai.djl.huggingface/tokenizers components in Red Hat Integration offerings are affected, and a fix is being pursued through the delegated update process for the affected stream. Red Hat\u0027s severity for this flaw (IMPORTANT, CVSS 7.4) is lower than the upstream rating (CRITICAL, CVSS 9.1) primarily because Red Hat assessed a higher attack complexity than the upstream analysis.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85228"
},
{
"category": "external",
"summary": "RHBZ#2531559",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531559"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85228"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85228",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85228"
},
{
"category": "external",
"summary": "https://aws.amazon.com/security/security-bulletins/2026-106-aws/",
"url": "https://aws.amazon.com/security/security-bulletins/2026-106-aws/"
},
{
"category": "external",
"summary": "https://github.com/deepjavalibrary/djl/releases/tag/v0.37.0",
"url": "https://github.com/deepjavalibrary/djl/releases/tag/v0.37.0"
}
],
"release_date": "2026-09-10T17:03:48.131000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project addressed this flaw in Deep Java Library 0.37.0; affected Red Hat Integration components are remediated through the delegated update process, and users should apply updated packages once available.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ai.djl/api: Integer overflow in tensor buffer validation in Deep Java Library"
},
{
"cve": "CVE-2026-93488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:39:48+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536887"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in Netty\u0027s SpdySessionHandler that could allow a remote attacker to exhaust system resources by sending a large number of SPDY SYN_STREAM frames. This can lead to an OutOfMemoryError and crash the affected service, impacting availability. The default configuration allows for an unlimited number of concurrent streams, making services using Netty with SPDY vulnerable to this resource exhaustion attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93488"
},
{
"category": "external",
"summary": "RHBZ#2536887",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536887"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93488",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93488"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93488"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:39:48+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams"
},
{
"cve": "CVE-2026-93491",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-10T00:40:47+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536891"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HttpServerCodec component. A remote, unauthenticated attacker can exploit this flaw by sending a series of pipelined HTTP/1.1 requests without reading responses, leading to unbounded memory growth and potential service unavailability in applications utilizing affected Netty versions. The issue stems from an unbounded queue used to track pipelined requests, which can be exhausted by a malicious client.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93491"
},
{
"category": "external",
"summary": "RHBZ#2536891",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536891"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93491",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93491"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93491"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.138.Final"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"
}
],
"release_date": "2026-09-10T00:40:47+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue"
},
{
"cve": "CVE-2026-93492",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:41:18+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536895"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate-impact flaw in Netty\u0027s HTTP/2 HpackEncoder allows a remote attacker to cause a Denial of Service. By sending specially crafted HTTP/2 SETTINGS frames with an oversized header table, an attacker can force the server to consume excessive CPU and memory resources, degrading service availability. This vulnerability affects applications utilizing Netty for HTTP/2 communication.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93492"
},
{
"category": "external",
"summary": "RHBZ#2536895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536895"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93492",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93492"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93492"
}
],
"release_date": "2026-09-10T00:41:18+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 HpackEncoder DoS with large table size"
},
{
"cve": "CVE-2026-93558",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:42:37+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit unbounded queue growth by sending pipelined HTTP/1.1 requests to a server supporting WebSocket compression. This can lead to JVM heap exhaustion and a denial of service, as memory is not reclaimed until the connection closes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93558"
},
{
"category": "external",
"summary": "RHBZ#2536932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536932"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93558",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93558"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93558"
}
],
"release_date": "2026-09-10T00:42:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service"
},
{
"cve": "CVE-2026-93562",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:45:54+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536951"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP/1 decoder allows HTTP request smuggling by incorrectly validating `Transfer-Encoding` headers. This can enable an attacker to inject arbitrary HTTP requests, primarily impacting Red Hat products deployed in environments with parser-differential proxies or load balancers, such as Red Hat AMQ, JBoss Fuse, Enterprise Application Platform, and Red Hat Build of Quarkus. The vulnerability arises from an incomplete fix, making it crucial to ensure consistent HTTP parsing across all network components.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93562"
},
{
"category": "external",
"summary": "RHBZ#2536951",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536951"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93562",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93562"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93562"
}
],
"release_date": "2026-09-10T00:45:54+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling"
},
{
"cve": "CVE-2026-93564",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:46:51+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536953"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important. It allows a remote, unauthenticated attacker to cause a denial of service by sending specially crafted PROXY-protocol v2 headers to a service utilizing the `netty-codec-haproxy` component. Repeated malformed requests can lead to memory exhaustion due to a reference-count leak in the `HAProxyMessageDecoder`, impacting the availability of affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93564"
},
{
"category": "external",
"summary": "RHBZ#2536953",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536953"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93564"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93564"
}
],
"release_date": "2026-09-10T00:46:51+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-haproxy: Netty: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)"
},
{
"cve": "CVE-2026-93565",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:47:19+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw affecting Netty-based RTSP servers and proxies. The `RtspDecoder` component incorrectly strips trailing control bytes from RTSP method tokens, allowing an attacker to bypass method-based access controls. This can lead to unauthorized actions or proxy laundering, where a malformed request is normalized and forwarded as legitimate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93565"
},
{
"category": "external",
"summary": "RHBZ#2536952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93565",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93565"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93565"
}
],
"release_date": "2026-09-10T00:47:19+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty RtspDecoder Method-Token Smuggling via Trailing Control Byte"
},
{
"cve": "CVE-2026-93566",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:47:37+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536954"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP codec allows HTTP request smuggling. The vulnerability stems from improper validation of chunk size lines, enabling an attacker to inject arbitrary HTTP requests. This could lead to cache poisoning or bypassing security controls in Red Hat products that use affected Netty components and process untrusted HTTP traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93566"
},
{
"category": "external",
"summary": "RHBZ#2536954",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536954"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93566",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93566"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93566"
}
],
"release_date": "2026-09-10T00:47:37+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to control characters in the chunk-size line"
},
{
"cve": "CVE-2026-93567",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:48:08+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536955"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in Netty\u0027s HTTP/1-to-HTTP/2 conversion can lead to an integrity loss in Red Hat products configured as HTTP/1-to-HTTP/2 proxies or gateways. A remote attacker can manipulate the Host header in an HTTP/1 CONNECT request, causing the HTTP/2 CONNECT request to use an attacker-controlled authority. This bypasses security controls such as tunnel allow-lists and egress policies, allowing connections to unintended upstream targets.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93567"
},
{
"category": "external",
"summary": "RHBZ#2536955",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536955"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93567",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93567"
}
],
"release_date": "2026-09-10T00:48:08+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority"
},
{
"cve": "CVE-2026-93568",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2026-09-10T00:50:42+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536961"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty\u0027s HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw where Netty\u0027s HTTP/2 and HTTP/3 HTTP-object conversion paths incorrectly downgrade Extended CONNECT requests to standard HTTP/1.1 CONNECT requests. This can lead to authorization bypasses in Red Hat products acting as gateways, proxies, or application servers that utilize Netty\u0027s HTTP-object adapters, as critical protocol and path information is lost, preventing proper policy enforcement.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93568"
},
{
"category": "external",
"summary": "RHBZ#2536961",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536961"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93568",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93568"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93568"
}
],
"release_date": "2026-09-10T00:50:42+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: io.netty/netty-codec-http3: Netty: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests"
},
{
"cve": "CVE-2026-93569",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-10T00:51:06+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536962"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty\u0027s HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in Netty-based HTTP/1 to HTTP/2 proxies or gateways allows an unauthenticated remote attacker to bypass security policies. The inconsistency in translating the HTTP/1 Host header to HTTP/2 :authority can lead to host or tenant security boundary bypasses, cache poisoning, or unintended request routing, despite initial security checks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93569"
},
{
"category": "external",
"summary": "RHBZ#2536962",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536962"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93569",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93569"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93569"
}
],
"release_date": "2026-09-10T00:51:06+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http2: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority"
},
{
"cve": "CVE-2026-93573",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-10T00:52:26+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in Netty\u0027s HTTP/1.1 decoder allows for HTTP request smuggling by incorrectly processing split `Transfer-Encoding` headers. When Netty is deployed with an intermediary that interprets these headers differently, an attacker could bypass front-end security controls or desynchronize request processing.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93573"
},
{
"category": "external",
"summary": "RHBZ#2536964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93573",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93573"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93573"
}
],
"release_date": "2026-09-10T00:52:26+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-3jrc-fchc-59pw for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling"
},
{
"cve": "CVE-2026-93574",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-10T00:52:52+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536966"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity flaw in Netty\u0027s HTTP/1.1 chunk-size parsing allows for HTTP request smuggling in proxy/backend deployments. By accepting post-digit whitespace in chunk-size tokens, Netty can misinterpret malformed chunked bodies, leading to a desynchronization between Netty and other HTTP components in the request path. This could enable an attacker to smuggle requests, potentially bypassing security controls or accessing unauthorized resources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93574"
},
{
"category": "external",
"summary": "RHBZ#2536966",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536966"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93574",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93574"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93574"
}
],
"release_date": "2026-09-10T00:52:52+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http: Netty: HTTP request smuggling via post-digit whitespace in chunk-size parsing"
},
{
"cve": "CVE-2026-93579",
"cwe": {
"id": "CWE-1035",
"name": "CWE-1035"
},
"discovery_date": "2026-09-10T00:55:17+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536970"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Netty\u0027s HTTP/2 implementation arises from disabled-by-default header value validation. When Netty-based applications act as HTTP/2 to HTTP/1.1 translation proxies or gateways, this can enable request smuggling or response splitting attacks by allowing prohibited control characters to be injected into HTTP/1.1 headers. Pure end-to-end HTTP/2 deployments are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93579"
},
{
"category": "external",
"summary": "RHBZ#2536970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536970"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93579"
}
],
"release_date": "2026-09-10T00:55:17+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "See https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72 for fixed versions and remediation guidance.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "io.netty/netty-codec-http2: Netty: HTTP/2 header field values are not validated by default (CR/LF/NUL passthrough)"
},
{
"cve": "CVE-2026-100655",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-26T13:36:58.243086+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2541863"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by exhausting server memory. Because the SPDY session handler does not restrict the number of concurrent streams initiated by a remote peer, an attacker can transmit an excessive volume of stream creation requests over a connection, triggering memory exhaustion and crashing the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important impact because an unauthenticated remote attacker can exhaust system memory and induce a denial of service, crashing the entire Java Virtual Machine without requiring prior privileges. Within Red Hat offerings, Netty is primarily utilized as an underlying networking transport framework across various middleware, developer tools, and containerized services. The exposure is limited to deployments and services where SPDY protocol handlers are actively integrated into the communication pipeline, as default HTTP configurations do not process these sessions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100655"
},
{
"category": "external",
"summary": "RHBZ#2541863",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541863"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100655",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100655"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100655",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100655"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7",
"url": "https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-spdysessionhandler",
"url": "https://www.vulncheck.com/advisories/netty-before-4.1.138-final-denial-of-service-via-spdysessionhandler"
}
],
"release_date": "2026-09-26T13:23:23.988000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded SPDY concurrent streams"
},
{
"cve": "CVE-2026-100656",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-09-26T13:31:00.195177+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2541803"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending numerous pipelined HTTP/1.1 requests over a single connection while withholding reads. Netty\u0027s HTTP server codec stores unanswered requests in an internal queue without a size limit, leading to excessive memory consumption and an eventual application crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an unauthenticated network attacker can trigger an application-wide denial of service through memory exhaustion without needing prior credentials or complex preconditions. In Red Hat environments, Netty is widely bundled as an underlying network engine across middleware and containerized offerings, including Red Hat Build of Keycloak, Quarkus, and JBoss EAP. When HTTP/1.1 services accept pipelined requests, a malicious client can continuously send incoming queries over an individual connection while intentionally pausing consumption of server responses, consuming system heap until the Java virtual machine crashes.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100656"
},
{
"category": "external",
"summary": "RHBZ#2541803",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541803"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100656",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100656"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100656",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100656"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq",
"url": "https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/netty-httpservercodec-unbounded-queue-growth-via-http-1.1-pipelining",
"url": "https://www.vulncheck.com/advisories/netty-httpservercodec-unbounded-queue-growth-via-http-1.1-pipelining"
}
],
"release_date": "2026-09-26T13:23:24.703000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining"
},
{
"cve": "CVE-2026-100666",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-26T13:41:45.877343+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2541907"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpServerCodec. A remote attacker can exploit this vulnerability to cause HTTP response desynchronization, leading to response splitting and potential information disclosure. By sending pipelined requests with informational headers followed by another request, the server misaligns outbound responses with queued inbound requests. Consequently, response data can be associated with the wrong request on reused connections, leading to the delivery of unintended content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in Netty\u0027s HttpServerCodec where processing pipelined HTTP/1.1 requests with 1xx informational responses causes HTTP response desynchronization. When a client sends a GET request with an \u0027Expect: 100-continue\u0027 header followed by a HEAD request, the server misaligns outbound responses with inbound requests, resulting in response splitting and unsafe connection reuse. This can lead to unintended information disclosure on reused connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Build of Debezium 3.6"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-100666"
},
{
"category": "external",
"summary": "RHBZ#2541907",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541907"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-100666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-100666"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-100666",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100666"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-2g6j-r8q9-5hr8",
"url": "https://github.com/netty/netty/security/advisories/GHSA-2g6j-r8q9-5hr8"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.17-response-desynchronization-via-httpservercodec",
"url": "https://www.vulncheck.com/advisories/netty-4.2.0-through-4.2.17-response-desynchronization-via-httpservercodec"
}
],
"release_date": "2026-09-26T13:23:31.961000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-15T14:45:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat Build of Debezium 3.6"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:83612"
},
{
"category": "workaround",
"details": "Update to io.netty:netty-codec-http version 4.2.17.Final or 4.1.137.Final or later, which fixes the response queue management in HttpServerCodec to properly pair responses with their originating requests.",
"product_ids": [
"Red Hat Build of Debezium 3.6"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat Build of Debezium 3.6"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "io.netty/netty-codec-http: Netty: HTTP response desynchronization via HttpServerCodec"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.