Към съдържанието
Търсене

CVE-2026-33871: netty, отказ на услуга

8.7

CVSS 4.0

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CONTINUATION` frames, combined with a bypass of existing size-based mitigations using zero-byte frames, allows an user to cause excessive CPU consumption with minimal bandwidth, rendering the server unresponsive. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Засегнати продукти

  • netty netty: < 4.1.132.Final; >= 4.2.0.Alpha1, < 4.2.10.Final
  • Red Hat Cryostat 4 on RHEL 9: 4.2.0-9 преди *
  • Red Hat Red Hat AMQ Broker 7.12.7: codec-http2 преди *
  • Red Hat Red Hat AMQ Broker 7.13.5: codec-http2 преди *
  • Red Hat Red Hat AMQ Broker 7.14.0: codec-http преди *; codec-http2 преди *
  • Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27: codec-http2 преди *
  • Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14: codec-http преди *; codec-http2 преди *
  • Red Hat Red Hat build of Quarkus 3.20.6: codec-http2 преди *
  • Red Hat Red Hat build of Quarkus 3.27.3: codec-http2 преди *
  • Red Hat Red Hat Data Grid 8.6.1: codec-http преди *; codec-http2 преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1: codec-http преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8: 0:4.1.132-1.Final_redhat_00001.1.el8eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9: 0:4.1.132-1.Final_redhat_00001.1.el9eap преди *
  • Red Hat Streams for Apache Kafka 2.9.4: codec-http преди *; codec-http2 преди *
  • Red Hat Streams for Apache Kafka 3.2.0
  • Red Hat Red Hat OpenShift AI 2.25: 1776756834 преди *
  • Red Hat Red Hat OpenShift Dev Spaces 3.27: 1776716842 преди *
  • Red Hat Cryostat 4
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AMQ Clients
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 2
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat build of Quarkus
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 8
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 3

Вид слабост

История

  • 27 март 2026 Публикувано

Други уязвимости в netty netty

Първоизточници

CVE-2026-33871: netty, отказ на услуга | freedomonline.bg