Към съдържанието
Търсене

CVE-2026-42584: netty, друго

7.3

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: има публичен пример за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Засегнати продукти

  • netty netty: >= 4.2.0.Alpha1, < 4.2.13.Final; < 4.1.133.Final
  • io.netty netty-codec-http: >= 4.2.0.Alpha1, < 4.2.13.Final; < 4.1.133.Final
  • Red Hat: още 34 продукта, добавени от Red Hat

    Cryostat 4 on RHEL 9, Red Hat AMQ Broker 7.13.6, Red Hat AMQ Broker 7.14.1, Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16, Red Hat build of Quarkus 3.27.4, Red Hat build of Quarkus 3.33.2, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8, Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9, Red Hat JBoss Enterprise Application Platform 8.1.7.GA, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8, Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9, Streams for Apache Kafka 3.2.1, Red Hat OpenShift AI 2.25, Red Hat OpenShift Dev Spaces 3.28, Red Hat OpenShift Dev Spaces 3.29, OpenShift Serverless, Red Hat AMQ Clients, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat Build of Keycloak, Red Hat build of OptaPlanner 8, Red Hat Data Grid 8, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat Process Automation 7, Red Hat Satellite 6, Red Hat Single Sign-On 7, streams for Apache Kafka 2

Вид слабост

История

  • 13 май 2026 Публикувано

Други уязвимости в netty netty

Първоизточници

CVE-2026-42584: netty, друго | freedomonline.bg