Loading story…
Red Hat disclosed and patched three upstream flaws affecting widely used Java networking components in multiple downstream products. CVE-2026-33871 is an Important-severity denial-of-service issue in Netty HTTP/2 handling that lets a remote attacker flood a server with CONTINUATION frames, including zero-byte frames, causing excessive CPU consumption and making the service unresponsive; the bug is mapped to CWE-770. CVE-2026-33870 affects Netty's HTTP/1.1 parsing and can enable HTTP request smuggling through incorrect handling of quoted strings in chunked transfer-encoding extension values. Both Netty issues were fixed upstream in versions 4.1.132.Final and 4.2.10.Final.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2026:17789 for Cryostat 4 on RHEL 9, addressing CVE-2026-1002 as well as Netty flaws CVE-2026-33870 and CVE-2026-33871.
Red Hat issued RHSA-2026:17668 for Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, fixing CVE-2026-33870 and CVE-2026-33871.
Red Hat released RHSA-2026:14276 for Red Hat AMQ Broker 7.12.7, addressing CVE-2026-33870 and CVE-2026-33871 in bundled Netty components.
Red Hat released RHSA-2026:14272 for Red Hat AMQ Broker 7.13.5, shipping fixes for CVE-2026-33870 and CVE-2026-33871.
Red Hat released RHSA-2026:8509 for Red Hat AMQ Broker 7.14.0, addressing both Netty vulnerabilities CVE-2026-33870 and CVE-2026-33871.
Red Hat published RHSA-2026:8159 for Red Hat Build of Apache Camel 4.14 for Quarkus 3.27, updating to RHBQ 3.27.3.GA and addressing CVE-2026-1002, CVE-2026-33870, and CVE-2026-33871.
Red Hat's CVE record for CVE-2026-33871 was made public, describing a Netty HTTP/2 denial-of-service flaw caused by unlimited processing of CONTINUATION frames.
Red Hat last modified its CVE-2026-33871 entry, reflecting updated vulnerability and remediation information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceaccess.redhat.com
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Netty published a broad set of security advisories covering **22 vulnerabilities** across its networking stack, with impacts ranging from remote denial of service to trust-boundary failures. The issues affect multiple modules and protocols, including **HTTP/2, HTTP/3, QUIC, DNS, Redis, SCTP, Unix domain sockets, HAProxy PROXY protocol v2, and TLS handling**. Reported consequences include uncontrolled memory allocation, `ByteBuf` and file descriptor leaks, failure to enforce HTTP/2 stream limits, DNS cache poisoning, improper TLS hostname validation, IPv6 subnet access-control bypass, request smuggling, and QUIC reflection or stateless reset abuse. One of the most serious flaws, **`CVE-2026-45416`**, allows a remote attacker to send as little as **nine bytes** in a crafted TLS `ClientHello` and trigger roughly **16 MiB** of unpooled direct-memory allocation per connection in Netty's SNI handling path. Because the buffer can remain allocated until the connection closes, repeated connections can exhaust direct memory and disrupt services. The flaw affects **Netty 4.1.x before `4.1.135.Final`** and **4.2.0.Final through `4.2.14.Final`**, and was fixed in **`4.1.135.Final`** and **`4.2.15.Final`**; the wider advisory set was published through Netty's GitHub security advisories and highlights the risk to Java applications that embed Netty as a dependency.
Jul 10, 2026
Red Hat addressed **CVE-2014-0193**, a low-severity denial-of-service flaw in Netty's `WebSocket08FrameDecoder`. An unauthenticated remote attacker could send a sequence of `TextWebSocketFrame` and `ContinuationWebSocketFrame` messages that caused uncontrolled memory aggregation, resulting in an `OutOfMemoryException` and potentially crashing or degrading an affected server. Netty fixed the issue in its 3.x and 4.x branches; Netty 3.2.x was not affected because it lacked the vulnerable WebSocket implementation. The remediation was delivered to affected JBoss products through Red Hat security advisories, including **RHSA-2014:1020** for JBoss EAP 6. Red Hat updated Netty to `netty-3.6.9-1.Final_redhat_1.1.ep6.el6`, incorporating upstream commit `4cc400ce2145a72820119b0eaab838d5d9263022`, and verified the fix in EAP 6.3.0.ER10. Organizations operating affected JBoss deployments should apply the relevant Red Hat errata and verify that bundled Netty components are updated.
Aug 31, 2026
Two high-severity denial-of-service vulnerabilities were disclosed in widely used Java infrastructure components, allowing remote attackers to exhaust CPU and memory and disrupt application availability without authentication. In Micronaut, `CVE-2026-33013` affects versions before `4.10.16` and `3.10.5` and is caused by improper handling of descending array indices during `application/x-www-form-urlencoded` body binding in `JsonBeanPropertyBinder::expandArrayToThreshold`. A crafted request using indexed parameters such as `authors[1].name` followed by `authors[0].name` can trigger a non-terminating loop, CPU exhaustion, and an `OutOfMemoryError`. Netty separately patched `CVE-2026-33871`, a denial-of-service flaw in HTTP/2 processing that affects versions before `4.1.132.Final` and `4.2.10.Final`. The bug lets attackers flood servers with `CONTINUATION` frames because the framework did not enforce a limit on their number, and existing size-based protections could be bypassed with zero-byte frames. The result is excessive CPU consumption with minimal bandwidth, potentially leaving HTTP/2 services unresponsive. The issues are tracked as `CWE-835` in Micronaut and `CWE-770` in Netty, and both vendors released fixed versions for affected branches.
Jun 29, 2026