Loading story…
Netty published a broad set of security advisories covering 22 vulnerabilities across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling. Reported consequences include uncontrolled memory allocation, ByteBuf and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse.
One of the most serious flaws, CVE-2026-45416, allows a remote attacker to send as little as nine bytes in a crafted TLS ClientHello and trigger roughly 16 MiB of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects Netty 4.1.x before 4.1.135.Final and 4.2.0.Final through 4.2.14.Final, and was fixed in 4.1.135.Final and 4.2.15.Final; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE-2026-45416 issue affecting Netty's SNI handler was fixed in versions 4.1.135.Final and 4.2.15.Final. The flaw allowed a crafted nine-byte TLS ClientHello to trigger roughly 16 MiB of direct-memory allocation per connection, enabling denial of service through memory exhaustion.
A security bulletin described 22 vulnerabilities affecting Netty components, including remote denial-of-service flaws, DNS cache poisoning, HTTP request smuggling, IPv6 subnet access-control bypass, QUIC abuse cases, and improper TLS hostname validation.
Netty's GitHub security advisories page listed multiple vulnerabilities as published on June 5, 2026, covering issues such as memory exhaustion, ByteBuf leaks, DNS cache poisoning, file descriptor leaks, HTTP/2 stream-limit enforcement failures, and SNI pre-allocation behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
zeropath.com
Open sourcecybersecurity-help.cz
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Netty released **4.1.135.Final** and **4.2.15.Final** to patch a large batch of security vulnerabilities across core networking components, with fixes spanning `netty-resolver-dns`, `netty-codec-http2`, `netty-handler`, `netty-codec-redis`, `netty-codec-haproxy`, native transports, and SCTP support. The DNS resolver fixes address multiple cache-poisoning paths, including predictable transaction IDs combined with a static UDP source port, missing bailiwick checks for **CNAME** records, and insufficient validation of **NS** records; one of those issues was later tracked as **CVE-2026-45674**. Netty also fixed a TLS flaw in which wrapping a plain `X509TrustManager` could silently disable hostname verification for clients, and an IPv6 access-control bypass in `IpSubnetFilterRule`, later assigned **CVE-2026-44249**.
Jun 29, 2026
Netty disclosed and fixed **CVE-2026-48059**, a memory leak in its HAProxy PROXY protocol v2 codec that can let remote clients exhaust server memory by sending syntactically valid headers with nested `PP2_TYPE_SSL` TLVs at depth two or greater. The flaw leaves the underlying pooled `ByteBuf` cumulation buffer permanently pinned even though parsing completes successfully and no exception is raised, creating an availability risk rather than a confidentiality or integrity impact. The issue affects Netty releases before `4.1.135.Final` and `4.2.15.Final`, and the project published fixes in those versions alongside a GitHub security advisory. Separately, Netty also merged a non-security correction for `memoryAddress()` handling in wrapped direct `ByteBuffer` paths when `Unsafe` is disabled, shipping that consistency fix in `4.2.14.Final` and auto-porting it to Netty 5.0, but the HAProxy memory-exhaustion bug is addressed in the later `4.2.15.Final` release.
Jun 29, 2026
Two high-severity denial-of-service vulnerabilities were disclosed in widely used Java infrastructure components, allowing remote attackers to exhaust CPU and memory and disrupt application availability without authentication. In Micronaut, `CVE-2026-33013` affects versions before `4.10.16` and `3.10.5` and is caused by improper handling of descending array indices during `application/x-www-form-urlencoded` body binding in `JsonBeanPropertyBinder::expandArrayToThreshold`. A crafted request using indexed parameters such as `authors[1].name` followed by `authors[0].name` can trigger a non-terminating loop, CPU exhaustion, and an `OutOfMemoryError`. Netty separately patched `CVE-2026-33871`, a denial-of-service flaw in HTTP/2 processing that affects versions before `4.1.132.Final` and `4.2.10.Final`. The bug lets attackers flood servers with `CONTINUATION` frames because the framework did not enforce a limit on their number, and existing size-based protections could be bypassed with zero-byte frames. The result is excessive CPU consumption with minimal bandwidth, potentially leaving HTTP/2 services unresponsive. The issues are tracked as `CWE-835` in Micronaut and `CWE-770` in Netty, and both vendors released fixed versions for affected branches.
Jun 29, 2026