Към съдържанието
Търсене

CVE-2026-45416: netty, отказ на услуга

7.5

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Засегнати продукти

  • netty netty: >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final
  • Red Hat Cryostat 4 on RHEL 9: 4.2.0-13 преди *
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1
  • Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
  • Red Hat Red Hat build of Quarkus 3.27.4.SP1
  • Red Hat Red Hat build of Quarkus 3.33.2.SP1
  • Red Hat Red Hat Data Grid 8.6.2
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7: 0:2.16.0-22.redhat_00057.1.el7eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8: 0:2.16.0-22.redhat_00057.1.el8eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9: 0:2.16.0-22.redhat_00057.1.el9eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA: 4.1.135.Final-redhat-00001 преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10: 0:801.7.1-1.GA_redhat_00001.1.el10eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8: 0:801.7.1-1.GA_redhat_00001.1.el8eap преди *
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9: 0:801.7.1-1.GA_redhat_00001.1.el9eap преди *
  • Red Hat Streams for Apache Kafka 2.9.4
  • Red Hat Streams for Apache Kafka 3.2.1
  • Red Hat Red Hat Offline Knowledge Portal 1.2.12: 1782239370 преди *
  • Red Hat Red Hat OpenShift AI 2.25: 1788198681 преди *
  • Red Hat Red Hat OpenShift Dev Spaces 3.30: 1787759145 преди *
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AMQ Clients
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat OpenShift Dev Spaces
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7

Вид слабост

История

  • 12 юни 2026 Публикувано

Други уязвимости в netty netty

Първоизточници

CVE-2026-45416: netty, отказ на услуга | freedomonline.bg