open-source-dependency-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerability

Netty fixes broad set of flaws including DNS poisoning, HTTP/2 DoS, and TLS verification bypass

Vulnerability Disclosure · 66 sources · Updated 3mo ago · First seen Jun 12, 2026

Netty released 4.1.135.Final and 4.2.15.Final to patch a large batch of security vulnerabilities across core networking components, with fixes spanning netty-resolver-dns, netty-codec-http2, netty-handler, netty-codec-redis, netty-codec-haproxy, native transports, and SCTP support. The DNS resolver fixes address multiple cache-poisoning paths, including predictable transaction IDs combined with a static UDP source port, missing bailiwick checks for CNAME records, and insufficient validation of NS records; one of those issues was later tracked as CVE-2026-45674. Netty also fixed a TLS flaw in which wrapping a plain X509TrustManager could silently disable hostname verification for clients, and an IPv6 access-control bypass in IpSubnetFilterRule, later assigned CVE-2026-44249.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

25 events · May 18, 2026 – Jun 15, 2026

Jun 15, 20265mo ago
CVE-2026-50011 disclosed for Netty Redis pre-allocation DoS flaw
A new reference disclosed CVE-2026-50011 affecting netty-codec-redis, where RedisArrayAggregator uses an untrusted array length to pre-allocate an ArrayList and can be driven into immediate excessive memory allocation and OutOfMemoryError. The report says affected versions are prior to 4.1.135.Final and 4.2.15.Final and notes the patch limits initial pre-allocation while allowing dynamic growth.
CVE-2026-50011: CVE-2026-50011: Unbounded Resource Pre-Allocation in Netty Redis Codec | CVEReports
Jun 15, 20265mo ago
CVE-2026-50010 disclosed for Netty TLS hostname verification bypass
A new reference disclosed CVE-2026-50010, a Netty TLS client vulnerability in which wrapping a legacy X509TrustManager as an X509ExtendedTrustManager can discard Socket and SSLEngine context, causing hostname verification to be skipped. The flaw can let any certificate signed by a trusted CA be accepted for the wrong domain, enabling man-in-the-middle style impersonation against affected clients.
CVE-2026-50010: CVE-2026-50010: Hostname Verification Bypass in Netty TLS Client | CVEReports
Jun 15, 20265mo ago
CVE-2026-50020 disclosed for Netty HTTP request smuggling flaw
A new reference disclosed CVE-2026-50020 / GHSA-hvcg-qmg6-jm4c affecting Netty's HTTP codec, where HttpObjectDecoder silently consumes leading ISO control bytes and can parse requests differently from an upstream proxy or WAF. The inconsistency can enable HTTP request smuggling and front-end security bypasses when Netty is deployed behind intermediaries that reuse persistent backend TCP connections.
CVE-2026-50020: CVE-2026-50020: HTTP Request Smuggling in Netty HttpObjectDecoder via Arbitrary Leading Control Bytes | CVEReports
Jun 15, 20265mo ago
CVE-2026-48748 is recorded for Netty HTTP/3 QPACK blocked-streams flaw
A CVE report published CVE-2026-48748 for Netty's HTTP/3 QpackDecoder vulnerability that allows blocked-stream limit bypass and can cause memory exhaustion. The report ties the issue to the previously disclosed QPACK blocked-streams flaw and describes cleanup shortcomings for blocked stream state.
CVE-2026-48748: CVE-2026-48748: Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion | CVEReports
Jun 12, 20265mo ago
CVE-2026-45674 is recorded for Netty CNAME bailiwick poisoning flaw
A CVE entry was published for Netty's DNS cache poisoning vulnerability caused by missing bailiwick checks on CNAME records in DnsResolveContext. The record says the vulnerability was recorded on June 12, 2026 and affects versions prior to 4.1.135.Final and 4.2.15.Final.
CVE-2026-45674 - Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Jun 11, 20265mo ago
CVE-2026-44249 is recorded for Netty IPv6 subnet filter bypass
A CVE entry was published for Netty's IPv6 subnet filter bypass flaw affecting netty-handler versions prior to 4.1.135.Final and 4.2.15.Final. The entry states the issue was received by security-advisories@github.com on June 11, 2026 and notes that patched Netty releases were already available.
CVE-2026-44249 - Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Jun 8, 20265mo ago
Netty discloses HTTP/2 Reset-style denial-of-service issue
Netty published advisory GHSA-563q-j3cm-6jxm describing an HTTP/2 denial-of-service issue tied to SETTINGS_MAX_HEADER_LIST_SIZE handling that can produce Rapid Reset-like effects with a different on-the-wire signature. The advisory credits Netflix researchers Jonathan Looney and Ashley Tolbert and states the issue is patched in 4.1.135.Final and 4.2.15.Final.
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty discloses QUIC stateless reset token exposure flaw
Netty published advisory GHSA-cq4q-cv5g-r8q5 for a vulnerability in io.netty:netty-codec-classes-quic where the default HMAC-based connection ID and stateless reset token generators share the same static key, allowing an on-path attacker to derive a connection's stateless reset token from header-visible connection IDs. The issue affects versions 4.2.0.Final through 4.2.14.Final, can enable spoofed Stateless Reset packets that terminate client connections, and is fixed in 4.2.15.Final.
QUIC stateless reset token material exposed through header-visible connection IDs · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty discloses HTTP/3 unbounded header-size denial-of-service flaw
Netty published advisory GHSA-c2rx-5r8w-8xr2 for a vulnerability in io.netty:netty-codec-http3 where Http3ConnectionHandler's default configuration does not enforce a maximum header size if a peer omits HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE. The issue affects versions 4.2.0.Final through 4.2.14.Final and can lead to memory exhaustion and OutOfMemoryError; it is fixed in 4.2.15.Final.
Vulnerable Default Configuration: Denial of Service via Unbounded HTTP/3 Header Size · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty discloses QUIC token validation flaw enabling reflection attacks
Netty published advisory GHSA-cmm3-54f8-px4j for a vulnerability in io.netty:netty-codec-classes-quic where the default NoQuicTokenHandler accepts any non-empty client-supplied token as valid. The issue affects versions 4.2.0.Final through 4.2.14.Final and can let attackers bypass QUIC anti-amplification limits to reflect full-size handshake traffic toward spoofed victim IPs; it is fixed in 4.2.15.Final.
Default QUIC token handler accepts any client-supplied token · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty discloses HTTP/3 QPACK blocked-streams memory exhaustion flaw
Netty published advisory GHSA-4grm-h2qv-h6w6 for a denial-of-service vulnerability in io.netty:netty-codec-http3 caused by bypassable blocked-stream limits in QpackDecoder when dynamic tables are enabled and the blocked-streams setting remains at its default of 0. The advisory says affected versions are 4.2.0.Final through 4.2.13.Final and that the issue is fixed in 4.2.15.Final.
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty publishes multiple GitHub security advisories for fixed vulnerabilities
Netty published a coordinated set of GitHub security advisories covering vulnerabilities fixed in 4.1.135.Final and 4.2.15.Final, including DNS cache poisoning, HTTP/2 denial of service, Redis memory exhaustion, HAProxy leaks, SCTP resource exhaustion, file descriptor leaks, IPv6 filter bypass, and hostname verification disablement.
Wrapping plain trust manager silently disables hostname verification · Advisory · netty/netty · GitHub
Jun 2, 20265mo ago
Netty releases versions 4.1.135.Final and 4.2.15.Final with security fixes
Netty released versions 4.1.135.Final and 4.2.15.Final, bundling fixes for numerous high-severity issues across components including DNS resolver, HTTP/2, Redis, HAProxy, SCTP, native transports, and TLS hostname verification handling.
Release netty-4.1.135.Final · netty/netty · GitHub
Jun 2, 20265mo ago
Netty fixes MQTT decoder handling of malformed no-payload packets
A Netty commit updated the MQTT decoder to reject malformed fixed-header-only packets, such as a PINGREQ with a non-zero Remaining Length, instead of misparsing trailing bytes as additional messages. The change added a regression test to ensure invalid no-payload MQTT frames are treated as a single malformed message in line with MQTT 3.1.1 and 5.0.
Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zer… · netty/netty@2394530 · GitHub
Jun 2, 20265mo ago
Netty patches ZstdDecoder to cap Zstandard memory usage
A Netty commit updated ZstdDecoder to bound decompression-related memory allocation by adding a default 4 MiB allocation cap and a configurable maxWindowLog limit. The change rejects Zstandard frames that declare larger windows, reducing per-stream memory amplification risk.
Add maxWindowLog parameter to ZstdDecoder to bound memory allocation … · netty/netty@0bd1657 · GitHub
Jun 2, 20265mo ago
Netty fixes HAProxy nested SSL TLV ByteBuf leak
Netty merged PR #16881 to fix a ByteBuf memory leak in HAProxy PROXY protocol v2 parsing when nested SSL TLVs appear at depth two or greater. The change updated HAProxyMessage release logic to recursively release nested TLVs via a new helper while preserving the existing tlvs() API behavior.
HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs by normanmaurer · Pull Request #16881 · netty/netty · GitHub
Jun 1, 20265mo ago
Netty adds configurable RedisArrayAggregator element limit
Netty pull request #16858 introduced a security-related change to RedisArrayAggregator that adds a configurable maximum element count, deprecates the previous constructor, and sets a default bound of 1,000,000 elements via a new system property. The change was intended to reduce excessive resource allocation caused by adversarial Redis array header messages and was merged into the 4.1 branch for 4.1.135.Final.
Configurable bound on RedisArrayAggregator by normanmaurer · Pull Request #16858 · netty/netty · GitHub
Jun 1, 20265mo ago
Netty fixes HTTP/2 data buffer cleanup to always release buffers
A Netty commit changed HTTP/2 data-processing logic to place buffer handling inside a try block and move buf.release() into a finally block. The update ensures buffers are released even if exceptions occur during onDataRead or flow-control processing, reducing the risk of resource leaks in HTTP/2 handling.
Merge commit from fork · netty/netty@3d45a1e · GitHub
Jun 1, 20265mo ago
Netty adds HAProxy nested SSL TLV leak regression test
A Netty commit added a unit test for HAProxy protocol v2 parsing with nested SSL TLVs, verifying correct encapsulation and that all nested TLVs are fully released after message cleanup. The change documents the code-level fix validation for the HAProxy-related resource leak addressed in later patched releases.
Merge commit from fork · netty/netty@270800e · GitHub
Jun 1, 20265mo ago
Netty fixes predictable DNS query IDs in resolver
A Netty pull request changed the DNS resolver to use SecureRandom instead of ThreadLocalRandom for DNS transaction IDs, addressing predictable query entropy that could aid Kaminsky-style cache poisoning attacks. The change was merged into the 4.1 branch and tied to milestone 4.1.135.Final.
DNS: Ensure query id is not predictible by normanmaurer · Pull Request #16870 · netty/netty · GitHub
Jun 1, 20265mo ago
Netty adds QpackDecoder blocked-stream limit regression tests
A Netty commit added QpackDecoder tests to verify that blocked streams are rejected when disallowed, that the configured maxBlockedStreams limit is enforced, and that blocked-stream capacity is released after unblocking. The change also introduced helper logic to construct blocking QPACK frames for these scenarios.
Merge commit from fork · netty/netty@75127ca · GitHub
May 21, 20266mo ago
Netty fixes io_uring wakeup race during eventfd shutdown
A Netty commit updated IoUringIoHandler to add an AtomicInteger-based wakeup gate and a closed flag so threads cannot write to the eventfd while the event loop is being destroyed. The change is intended to prevent EBADF errors and accidental writes to a recycled file descriptor during io_uring shutdown.
Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup (#16836) · netty/netty@b022b47 · GitHub
May 21, 20266mo ago
Netty opens PR to pass maxAllocation to Brotli and Zstd decoders
Netty pull request #16844 proposed passing a maxAllocation limit to Brotli and Zstd decoders, indicating work to constrain decompression-related memory allocation in those codecs. This represents an earlier development preceding the later released ZstdDecoder memory-usage fix.
Pass maxAllocation to Brotli and Zstd decoders by fedinskiy · Pull Request #16844 · netty/netty · GitHub
May 20, 20266mo ago
Netty fixes MQTT decoder size check after variable-header replay
A Netty commit corrected MQTT decoder logic so malformed PUBLISH packets that trigger REPLAY during variable-header parsing are checked against the current packet size rather than the cumulated buffer, preventing trailing bytes from later packets from causing an incorrect TooLongFrameException. The change also added regression tests covering malformed split packets and oversized current packets.
Fix MQTT decoder size check after variable header replay (#16787) · netty/netty@72df658 · GitHub
May 18, 20266mo ago
Netty fixes SSL ResumptionController trust manager wrapping
A Netty commit corrected SSL trust manager handling so OpenSslX509TrustManagerWrapper.wrapIfNeeded() uses the possibly already wrapped trust manager variable rather than the original cast object. The change preserves prior wrapping performed by the resumption controller and fixes the trust-manager wrapping logic in Netty's SSL handler.
Fix ResumptionController wrapping (#16815) · netty/netty@c328ba2 · GitHub

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

18 linked

Netty TLS ClientHello Eager Allocation Denial of Service (CVE-2026-45416)Memory leak denial of service in Netty HAProxy SSL TLV decoding (CVE-2026-44893)DNS cache poisoning in Netty DnsResolveContext (CVE-2026-45674)Netty Unix-domain socket file descriptor leak (CVE-2026-45536)Memory Exhaustion in Netty RedisArrayAggregator via Deeply Nested Arrays (CVE-2026-44250)Unbounded SCTP Fragment Reassembly in Netty (CVE-2026-46340)Denial of Service via Uncontrolled HTTP/2 Concurrent Streams in Netty (CVE-2026-47244)DNS cache poisoning in Netty through insufficient NS-record bailiwick validation (CVE-2026-47691)IPv6 Subnet Filter Bypass in Netty netty-handler (CVE-2026-44249)DNS cache poisoning via predictable transaction IDs in Netty DNS resolver (CVE-2026-45673)+8 more

Affected products

2 linked

NettyNetty

Organizations

1 linked

Netty

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

50 references tracked. Mallory keeps watching after this page renders.

CvereportsAdvisories · Jun 15, 2026

CVE-2026-50009: CVE-2026-50009: Stateless Reset Token Exposure in Netty QUIC | CVEReportsOpen source ↗

CvereportsAdvisories · Jun 15, 2026

CVE-2026-50020: CVE-2026-50020: HTTP Request Smuggling in Netty HttpObjectDecoder via Arbitrary Leading Control Bytes | CVEReportsOpen source ↗

CvereportsAdvisories · Jun 15, 2026

CVE-2026-50560: CVE-2026-50560: Denial of Service in Netty HTTP/2 Codec via Max Header List Size Exception | CVEReportsOpen source ↗

CvereportsAdvisories · Jun 15, 2026

CVE-2026-48748: CVE-2026-48748: Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion | CVEReportsOpen source ↗

42 additional sources from 01-06-2026 to 15-06-2026

UnclassifiedNews · Jun 1, 2026

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by netty-project-bot · Pull Request #16890 · netty/netty · GitHubOpen source ↗

Github WebNews · Jun 1, 2026

MQTT: Reject malformed no-payload packets with non-zero Remaining Len… · netty/netty@d89cf88 · GitHubOpen source ↗

Github WebNews · Jun 1, 2026

Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zero Remaining Length by netty-project-bot · Pull Request #16890 · netty/netty · GitHubOpen source ↗

Github WebNews · Jun 1, 2026

DNS: Ensure query id is not predictible by normanmaurer · Pull Request #16870 · netty/netty · GitHubOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News

open-source-dependency-vulnerabilitywidely-deployed-product-advisoryidentity-authentication-vulnerability

Netty fixes broad set of flaws including DNS poisoning, HTTP/2 DoS, and TLS verification bypass

Vulnerability Disclosure · 66 sources · Updated 3mo ago · First seen Jun 12, 2026

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

25 events · May 18, 2026 – Jun 15, 2026

Jun 15, 20265mo ago
CVE-2026-50011 disclosed for Netty Redis pre-allocation DoS flaw
A new reference disclosed CVE-2026-50011 affecting netty-codec-redis, where RedisArrayAggregator uses an untrusted array length to pre-allocate an ArrayList and can be driven into immediate excessive memory allocation and OutOfMemoryError. The report says affected versions are prior to 4.1.135.Final and 4.2.15.Final and notes the patch limits initial pre-allocation while allowing dynamic growth.
CVE-2026-50011: CVE-2026-50011: Unbounded Resource Pre-Allocation in Netty Redis Codec | CVEReports
Jun 15, 20265mo ago
CVE-2026-50010 disclosed for Netty TLS hostname verification bypass
A new reference disclosed CVE-2026-50010, a Netty TLS client vulnerability in which wrapping a legacy X509TrustManager as an X509ExtendedTrustManager can discard Socket and SSLEngine context, causing hostname verification to be skipped. The flaw can let any certificate signed by a trusted CA be accepted for the wrong domain, enabling man-in-the-middle style impersonation against affected clients.
CVE-2026-50010: CVE-2026-50010: Hostname Verification Bypass in Netty TLS Client | CVEReports
Jun 15, 20265mo ago
CVE-2026-50020 disclosed for Netty HTTP request smuggling flaw
A new reference disclosed CVE-2026-50020 / GHSA-hvcg-qmg6-jm4c affecting Netty's HTTP codec, where HttpObjectDecoder silently consumes leading ISO control bytes and can parse requests differently from an upstream proxy or WAF. The inconsistency can enable HTTP request smuggling and front-end security bypasses when Netty is deployed behind intermediaries that reuse persistent backend TCP connections.
CVE-2026-50020: CVE-2026-50020: HTTP Request Smuggling in Netty HttpObjectDecoder via Arbitrary Leading Control Bytes | CVEReports
Jun 15, 20265mo ago
CVE-2026-48748 is recorded for Netty HTTP/3 QPACK blocked-streams flaw
A CVE report published CVE-2026-48748 for Netty's HTTP/3 QpackDecoder vulnerability that allows blocked-stream limit bypass and can cause memory exhaustion. The report ties the issue to the previously disclosed QPACK blocked-streams flaw and describes cleanup shortcomings for blocked stream state.
CVE-2026-48748: CVE-2026-48748: Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion | CVEReports
Jun 12, 20265mo ago
CVE-2026-45674 is recorded for Netty CNAME bailiwick poisoning flaw
A CVE entry was published for Netty's DNS cache poisoning vulnerability caused by missing bailiwick checks on CNAME records in DnsResolveContext. The record says the vulnerability was recorded on June 12, 2026 and affects versions prior to 4.1.135.Final and 4.2.15.Final.
CVE-2026-45674 - Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Jun 11, 20265mo ago
CVE-2026-44249 is recorded for Netty IPv6 subnet filter bypass
A CVE entry was published for Netty's IPv6 subnet filter bypass flaw affecting netty-handler versions prior to 4.1.135.Final and 4.2.15.Final. The entry states the issue was received by security-advisories@github.com on June 11, 2026 and notes that patched Netty releases were already available.
CVE-2026-44249 - Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Jun 8, 20265mo ago
Netty discloses HTTP/2 Reset-style denial-of-service issue
Netty published advisory GHSA-563q-j3cm-6jxm describing an HTTP/2 denial-of-service issue tied to SETTINGS_MAX_HEADER_LIST_SIZE handling that can produce Rapid Reset-like effects with a different on-the-wire signature. The advisory credits Netflix researchers Jonathan Looney and Ashley Tolbert and states the issue is patched in 4.1.135.Final and 4.2.15.Final.
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty discloses QUIC stateless reset token exposure flaw
Netty published advisory GHSA-cq4q-cv5g-r8q5 for a vulnerability in io.netty:netty-codec-classes-quic where the default HMAC-based connection ID and stateless reset token generators share the same static key, allowing an on-path attacker to derive a connection's stateless reset token from header-visible connection IDs. The issue affects versions 4.2.0.Final through 4.2.14.Final, can enable spoofed Stateless Reset packets that terminate client connections, and is fixed in 4.2.15.Final.
QUIC stateless reset token material exposed through header-visible connection IDs · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty discloses HTTP/3 unbounded header-size denial-of-service flaw
Netty published advisory GHSA-c2rx-5r8w-8xr2 for a vulnerability in io.netty:netty-codec-http3 where Http3ConnectionHandler's default configuration does not enforce a maximum header size if a peer omits HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE. The issue affects versions 4.2.0.Final through 4.2.14.Final and can lead to memory exhaustion and OutOfMemoryError; it is fixed in 4.2.15.Final.
Vulnerable Default Configuration: Denial of Service via Unbounded HTTP/3 Header Size · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty discloses QUIC token validation flaw enabling reflection attacks
Netty published advisory GHSA-cmm3-54f8-px4j for a vulnerability in io.netty:netty-codec-classes-quic where the default NoQuicTokenHandler accepts any non-empty client-supplied token as valid. The issue affects versions 4.2.0.Final through 4.2.14.Final and can let attackers bypass QUIC anti-amplification limits to reflect full-size handshake traffic toward spoofed victim IPs; it is fixed in 4.2.15.Final.
Default QUIC token handler accepts any client-supplied token · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty discloses HTTP/3 QPACK blocked-streams memory exhaustion flaw
Netty published advisory GHSA-4grm-h2qv-h6w6 for a denial-of-service vulnerability in io.netty:netty-codec-http3 caused by bypassable blocked-stream limits in QpackDecoder when dynamic tables are enabled and the blocked-streams setting remains at its default of 0. The advisory says affected versions are 4.2.0.Final through 4.2.13.Final and that the issue is fixed in 4.2.15.Final.
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion · Advisory · netty/netty · GitHub
Jun 5, 20265mo ago
Netty publishes multiple GitHub security advisories for fixed vulnerabilities
Netty published a coordinated set of GitHub security advisories covering vulnerabilities fixed in 4.1.135.Final and 4.2.15.Final, including DNS cache poisoning, HTTP/2 denial of service, Redis memory exhaustion, HAProxy leaks, SCTP resource exhaustion, file descriptor leaks, IPv6 filter bypass, and hostname verification disablement.
Wrapping plain trust manager silently disables hostname verification · Advisory · netty/netty · GitHub
Jun 2, 20265mo ago
Netty releases versions 4.1.135.Final and 4.2.15.Final with security fixes
Netty released versions 4.1.135.Final and 4.2.15.Final, bundling fixes for numerous high-severity issues across components including DNS resolver, HTTP/2, Redis, HAProxy, SCTP, native transports, and TLS hostname verification handling.
Release netty-4.1.135.Final · netty/netty · GitHub
Jun 2, 20265mo ago
Netty fixes MQTT decoder handling of malformed no-payload packets
A Netty commit updated the MQTT decoder to reject malformed fixed-header-only packets, such as a PINGREQ with a non-zero Remaining Length, instead of misparsing trailing bytes as additional messages. The change added a regression test to ensure invalid no-payload MQTT frames are treated as a single malformed message in line with MQTT 3.1.1 and 5.0.
Auto-port 4.2: MQTT: Reject malformed no-payload packets with non-zer… · netty/netty@2394530 · GitHub
Jun 2, 20265mo ago
Netty patches ZstdDecoder to cap Zstandard memory usage
A Netty commit updated ZstdDecoder to bound decompression-related memory allocation by adding a default 4 MiB allocation cap and a configurable maxWindowLog limit. The change rejects Zstandard frames that declare larger windows, reducing per-stream memory amplification risk.
Add maxWindowLog parameter to ZstdDecoder to bound memory allocation … · netty/netty@0bd1657 · GitHub
Jun 2, 20265mo ago
Netty fixes HAProxy nested SSL TLV ByteBuf leak
Netty merged PR #16881 to fix a ByteBuf memory leak in HAProxy PROXY protocol v2 parsing when nested SSL TLVs appear at depth two or greater. The change updated HAProxyMessage release logic to recursively release nested TLVs via a new helper while preserving the existing tlvs() API behavior.
HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs by normanmaurer · Pull Request #16881 · netty/netty · GitHub
Jun 1, 20265mo ago
Netty adds configurable RedisArrayAggregator element limit
Netty pull request #16858 introduced a security-related change to RedisArrayAggregator that adds a configurable maximum element count, deprecates the previous constructor, and sets a default bound of 1,000,000 elements via a new system property. The change was intended to reduce excessive resource allocation caused by adversarial Redis array header messages and was merged into the 4.1 branch for 4.1.135.Final.
Configurable bound on RedisArrayAggregator by normanmaurer · Pull Request #16858 · netty/netty · GitHub
Jun 1, 20265mo ago
Netty fixes HTTP/2 data buffer cleanup to always release buffers
A Netty commit changed HTTP/2 data-processing logic to place buffer handling inside a try block and move buf.release() into a finally block. The update ensures buffers are released even if exceptions occur during onDataRead or flow-control processing, reducing the risk of resource leaks in HTTP/2 handling.
Merge commit from fork · netty/netty@3d45a1e · GitHub
Jun 1, 20265mo ago
Netty adds HAProxy nested SSL TLV leak regression test
A Netty commit added a unit test for HAProxy protocol v2 parsing with nested SSL TLVs, verifying correct encapsulation and that all nested TLVs are fully released after message cleanup. The change documents the code-level fix validation for the HAProxy-related resource leak addressed in later patched releases.
Merge commit from fork · netty/netty@270800e · GitHub
Jun 1, 20265mo ago
Netty fixes predictable DNS query IDs in resolver
A Netty pull request changed the DNS resolver to use SecureRandom instead of ThreadLocalRandom for DNS transaction IDs, addressing predictable query entropy that could aid Kaminsky-style cache poisoning attacks. The change was merged into the 4.1 branch and tied to milestone 4.1.135.Final.
DNS: Ensure query id is not predictible by normanmaurer · Pull Request #16870 · netty/netty · GitHub
Jun 1, 20265mo ago
Netty adds QpackDecoder blocked-stream limit regression tests
A Netty commit added QpackDecoder tests to verify that blocked streams are rejected when disallowed, that the configured maxBlockedStreams limit is enforced, and that blocked-stream capacity is released after unblocking. The change also introduced helper logic to construct blocking QPACK frames for these scenarios.
Merge commit from fork · netty/netty@75127ca · GitHub
May 21, 20266mo ago
Netty fixes io_uring wakeup race during eventfd shutdown
A Netty commit updated IoUringIoHandler to add an AtomicInteger-based wakeup gate and a closed flag so threads cannot write to the eventfd while the event loop is being destroyed. The change is intended to prevent EBADF errors and accidental writes to a recycled file descriptor during io_uring shutdown.
Fix race in io.netty.channel.uring.IoUringIoHandler.wakeup (#16836) · netty/netty@b022b47 · GitHub
May 21, 20266mo ago
Netty opens PR to pass maxAllocation to Brotli and Zstd decoders
Netty pull request #16844 proposed passing a maxAllocation limit to Brotli and Zstd decoders, indicating work to constrain decompression-related memory allocation in those codecs. This represents an earlier development preceding the later released ZstdDecoder memory-usage fix.
Pass maxAllocation to Brotli and Zstd decoders by fedinskiy · Pull Request #16844 · netty/netty · GitHub
May 20, 20266mo ago
Netty fixes MQTT decoder size check after variable-header replay
A Netty commit corrected MQTT decoder logic so malformed PUBLISH packets that trigger REPLAY during variable-header parsing are checked against the current packet size rather than the cumulated buffer, preventing trailing bytes from later packets from causing an incorrect TooLongFrameException. The change also added regression tests covering malformed split packets and oversized current packets.
Fix MQTT decoder size check after variable header replay (#16787) · netty/netty@72df658 · GitHub
May 18, 20266mo ago
Netty fixes SSL ResumptionController trust manager wrapping
A Netty commit corrected SSL trust manager handling so OpenSslX509TrustManagerWrapper.wrapIfNeeded() uses the possibly already wrapped trust manager variable rather than the original cast object. The change preserves prior wrapping performed by the resumption controller and fixes the trust-manager wrapping logic in Netty's SSL handler.
Fix ResumptionController wrapping (#16815) · netty/netty@c328ba2 · GitHub

Linked entities