Loading story…
Netty released 4.1.135.Final and 4.2.15.Final to patch a large batch of security vulnerabilities across core networking components, with fixes spanning netty-resolver-dns, netty-codec-http2, netty-handler, netty-codec-redis, netty-codec-haproxy, native transports, and SCTP support. The DNS resolver fixes address multiple cache-poisoning paths, including predictable transaction IDs combined with a static UDP source port, missing bailiwick checks for CNAME records, and insufficient validation of NS records; one of those issues was later tracked as CVE-2026-45674. Netty also fixed a TLS flaw in which wrapping a plain X509TrustManager could silently disable hostname verification for clients, and an IPv6 access-control bypass in IpSubnetFilterRule, later assigned CVE-2026-44249.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
25 events from the most recent confirmed update back to the earliest known activity.
A new reference disclosed CVE-2026-50011 affecting netty-codec-redis, where RedisArrayAggregator uses an untrusted array length to pre-allocate an ArrayList and can be driven into immediate excessive memory allocation and OutOfMemoryError. The report says affected versions are prior to 4.1.135.Final and 4.2.15.Final and notes the patch limits initial pre-allocation while allowing dynamic growth.
A new reference disclosed CVE-2026-50010, a Netty TLS client vulnerability in which wrapping a legacy X509TrustManager as an X509ExtendedTrustManager can discard Socket and SSLEngine context, causing hostname verification to be skipped. The flaw can let any certificate signed by a trusted CA be accepted for the wrong domain, enabling man-in-the-middle style impersonation against affected clients.
A new reference disclosed CVE-2026-50020 / GHSA-hvcg-qmg6-jm4c affecting Netty's HTTP codec, where HttpObjectDecoder silently consumes leading ISO control bytes and can parse requests differently from an upstream proxy or WAF. The inconsistency can enable HTTP request smuggling and front-end security bypasses when Netty is deployed behind intermediaries that reuse persistent backend TCP connections.
A CVE report published CVE-2026-48748 for Netty's HTTP/3 QpackDecoder vulnerability that allows blocked-stream limit bypass and can cause memory exhaustion. The report ties the issue to the previously disclosed QPACK blocked-streams flaw and describes cleanup shortcomings for blocked stream state.
A CVE entry was published for Netty's DNS cache poisoning vulnerability caused by missing bailiwick checks on CNAME records in DnsResolveContext. The record says the vulnerability was recorded on June 12, 2026 and affects versions prior to 4.1.135.Final and 4.2.15.Final.
A CVE entry was published for Netty's IPv6 subnet filter bypass flaw affecting netty-handler versions prior to 4.1.135.Final and 4.2.15.Final. The entry states the issue was received by security-advisories@github.com on June 11, 2026 and notes that patched Netty releases were already available.
Netty published advisory GHSA-563q-j3cm-6jxm describing an HTTP/2 denial-of-service issue tied to SETTINGS_MAX_HEADER_LIST_SIZE handling that can produce Rapid Reset-like effects with a different on-the-wire signature. The advisory credits Netflix researchers Jonathan Looney and Ashley Tolbert and states the issue is patched in 4.1.135.Final and 4.2.15.Final.
Netty published advisory GHSA-cq4q-cv5g-r8q5 for a vulnerability in io.netty:netty-codec-classes-quic where the default HMAC-based connection ID and stateless reset token generators share the same static key, allowing an on-path attacker to derive a connection's stateless reset token from header-visible connection IDs. The issue affects versions 4.2.0.Final through 4.2.14.Final, can enable spoofed Stateless Reset packets that terminate client connections, and is fixed in 4.2.15.Final.
Netty published advisory GHSA-c2rx-5r8w-8xr2 for a vulnerability in io.netty:netty-codec-http3 where Http3ConnectionHandler's default configuration does not enforce a maximum header size if a peer omits HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE. The issue affects versions 4.2.0.Final through 4.2.14.Final and can lead to memory exhaustion and OutOfMemoryError; it is fixed in 4.2.15.Final.
Netty published advisory GHSA-cmm3-54f8-px4j for a vulnerability in io.netty:netty-codec-classes-quic where the default NoQuicTokenHandler accepts any non-empty client-supplied token as valid. The issue affects versions 4.2.0.Final through 4.2.14.Final and can let attackers bypass QUIC anti-amplification limits to reflect full-size handshake traffic toward spoofed victim IPs; it is fixed in 4.2.15.Final.
Netty published advisory GHSA-4grm-h2qv-h6w6 for a denial-of-service vulnerability in io.netty:netty-codec-http3 caused by bypassable blocked-stream limits in QpackDecoder when dynamic tables are enabled and the blocked-streams setting remains at its default of 0. The advisory says affected versions are 4.2.0.Final through 4.2.13.Final and that the issue is fixed in 4.2.15.Final.
Netty published a coordinated set of GitHub security advisories covering vulnerabilities fixed in 4.1.135.Final and 4.2.15.Final, including DNS cache poisoning, HTTP/2 denial of service, Redis memory exhaustion, HAProxy leaks, SCTP resource exhaustion, file descriptor leaks, IPv6 filter bypass, and hostname verification disablement.
Netty released versions 4.1.135.Final and 4.2.15.Final, bundling fixes for numerous high-severity issues across components including DNS resolver, HTTP/2, Redis, HAProxy, SCTP, native transports, and TLS hostname verification handling.
A Netty commit updated the MQTT decoder to reject malformed fixed-header-only packets, such as a PINGREQ with a non-zero Remaining Length, instead of misparsing trailing bytes as additional messages. The change added a regression test to ensure invalid no-payload MQTT frames are treated as a single malformed message in line with MQTT 3.1.1 and 5.0.
A Netty commit updated ZstdDecoder to bound decompression-related memory allocation by adding a default 4 MiB allocation cap and a configurable maxWindowLog limit. The change rejects Zstandard frames that declare larger windows, reducing per-stream memory amplification risk.
Netty merged PR #16881 to fix a ByteBuf memory leak in HAProxy PROXY protocol v2 parsing when nested SSL TLVs appear at depth two or greater. The change updated HAProxyMessage release logic to recursively release nested TLVs via a new helper while preserving the existing tlvs() API behavior.
Netty pull request #16858 introduced a security-related change to RedisArrayAggregator that adds a configurable maximum element count, deprecates the previous constructor, and sets a default bound of 1,000,000 elements via a new system property. The change was intended to reduce excessive resource allocation caused by adversarial Redis array header messages and was merged into the 4.1 branch for 4.1.135.Final.
A Netty commit changed HTTP/2 data-processing logic to place buffer handling inside a try block and move buf.release() into a finally block. The update ensures buffers are released even if exceptions occur during onDataRead or flow-control processing, reducing the risk of resource leaks in HTTP/2 handling.
A Netty commit added a unit test for HAProxy protocol v2 parsing with nested SSL TLVs, verifying correct encapsulation and that all nested TLVs are fully released after message cleanup. The change documents the code-level fix validation for the HAProxy-related resource leak addressed in later patched releases.
A Netty pull request changed the DNS resolver to use SecureRandom instead of ThreadLocalRandom for DNS transaction IDs, addressing predictable query entropy that could aid Kaminsky-style cache poisoning attacks. The change was merged into the 4.1 branch and tied to milestone 4.1.135.Final.
A Netty commit added QpackDecoder tests to verify that blocked streams are rejected when disallowed, that the configured maxBlockedStreams limit is enforced, and that blocked-stream capacity is released after unblocking. The change also introduced helper logic to construct blocking QPACK frames for these scenarios.
A Netty commit updated IoUringIoHandler to add an AtomicInteger-based wakeup gate and a closed flag so threads cannot write to the eventfd while the event loop is being destroyed. The change is intended to prevent EBADF errors and accidental writes to a recycled file descriptor during io_uring shutdown.
Netty pull request #16844 proposed passing a maxAllocation limit to Brotli and Zstd decoders, indicating work to constrain decompression-related memory allocation in those codecs. This represents an earlier development preceding the later released ZstdDecoder memory-usage fix.
A Netty commit corrected MQTT decoder logic so malformed PUBLISH packets that trigger REPLAY during variable-header parsing are checked against the current packet size rather than the cumulated buffer, preventing trailing bytes from later packets from causing an incorrect TooLongFrameException. The change also added regression tests covering malformed split packets and oversized current packets.
A Netty commit corrected SSL trust manager handling so OpenSslX509TrustManagerWrapper.wrapIfNeeded() uses the possibly already wrapped trust manager variable rather than the original cast object. The change preserves prior wrapping performed by the resumption controller and fixes the trust-manager wrapping logic in Netty's SSL handler.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
50 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcecvereports.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Netty published a broad set of security advisories covering **22 vulnerabilities** across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including **HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling**. Reported consequences include uncontrolled memory allocation, `ByteBuf` and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse. One of the most serious flaws, **`CVE-2026-45416`**, allows a remote attacker to send as little as **nine bytes** in a crafted TLS `ClientHello` and trigger roughly **16 MiB** of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects **Netty 4.1.x before `4.1.135.Final`** and **4.2.0.Final through `4.2.14.Final`**, and was fixed in **`4.1.135.Final`** and **`4.2.15.Final`**; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.
Jul 10, 2026
Netty disclosed and fixed **CVE-2026-48059**, a memory leak in its HAProxy PROXY protocol v2 codec that can let remote clients exhaust server memory by sending syntactically valid headers with nested `PP2_TYPE_SSL` TLVs at depth two or greater. The flaw leaves the underlying pooled `ByteBuf` cumulation buffer permanently pinned even though parsing completes successfully and no exception is raised, creating an availability risk rather than a confidentiality or integrity impact. The issue affects Netty releases before `4.1.135.Final` and `4.2.15.Final`, and the project published fixes in those versions alongside a GitHub security advisory. Separately, Netty also merged a non-security correction for `memoryAddress()` handling in wrapped direct `ByteBuffer` paths when `Unsafe` is disabled, shipping that consistency fix in `4.2.14.Final` and auto-porting it to Netty 5.0, but the HAProxy memory-exhaustion bug is addressed in the later `4.2.15.Final` release.
Jun 29, 2026
Netty corrected an MQTT decoder regression introduced during remediation for **`CVE-2026-44248`**, after the library began incorrectly rejecting valid fragmented or batched MQTT packets with **`TooLongFrameException`**. The flaw came from using `readableBytes()` inside a `ReplayingDecoder` path, where the value reflected the cumulation buffer or an effectively unbounded readable size instead of the current packet’s declared remaining length during variable-header replay handling. The project fixed the logic in pull request **#16787** by basing the size check on **`bytesRemainingBeforeVariableHeader`** and added regression tests covering both valid in-limit packets and oversized packets. The fix was merged into the **4.2** branch for release in **`4.2.14.Final`**, then auto-ported to **4.1** in **#16838** and later re-applied in **#16916** after a subsequent security merge reintroduced the broken code. Netty also addressed a related `ReplayingDecoder` `readableBytes()` issue in **#16813** and auto-port **#16919**, ensuring early replay handling works correctly for incomplete MQTT properties blocks. Downstream projects including **ArcadeDB** and **ThingsBoard** referenced or adopted the updated Netty releases to resolve the decoder behavior.
Jun 29, 2026