CVE-2023-5236

Infinispan: circular reference on marshalling leads to dos

A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.

CVSS 3.1 · 4.4 Medium EPSS 1.1% KEV · Not listed

Vendors

Infinispan Redhat

Products

Infinispan Camel Quarkus Camel Spring Boot and 9 more

CVE-2024-5971

Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Redhat

Products

Apache Camel Hawtio Apache Camel Spring Boot Build Keycloak and 9 more

CVE-2026-114370

Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Camel Spring Boot Enterprise Linux Jboss Enterprise Application Platform and 3 more

CVE-2026-93579

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http2 Amq Broker Apicurio Registry and 20 more

CVE-2026-93492

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http2 Amq Broker Amq Broker 7 and 21 more

CVE-2026-93574

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Amq Clients and 19 more

CVE-2026-93573

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Amq Clients and 19 more

CVE-2026-93566

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Amq Broker 7 Amq Broker Amq Clients and 19 more

CVE-2026-93562

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Amq Clients and 19 more

CVE-2026-93569

Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests.

CVSS 3.1 · 8.2 High EPSS 2.4% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Apache Camel Quarkus and 20 more

CVE-2026-93568

Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Apache Camel Quarkus and 21 more

CVE-2026-93567

Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http2 Amq Broker Apache Camel Quarkus and 21 more

CVE-2026-93565

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Amq Broker 7 Amq Broker Amq Clients and 20 more

CVE-2026-93564

Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Amq Broker Amq Broker 7 Apache Camel Quarkus and 17 more

CVE-2026-93558

Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Amq Broker 7 and 21 more

CVE-2026-93491

Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Amq Broker 7 and 20 more

CVE-2026-93488

Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Io.netty Redhat

Products

Netty-codec-http Amq Broker Amq Clients and 20 more

CVE-2024-3653

Undertow: learningpushhandler can lead to remote memory dos attacks

A vulnerability was found in Undertow. This issue requires enabling the learning-push handler in the server's config, which is disabled by default, leaving the maxAge config in the handler unconfigured. The default is -1, which makes the handler vulnerable. If someone overwrites that config, the server is not subject to the attack. The attacker needs to be able to reach the server with a normal HTTP request.

CVSS 3.1 · 5.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Redhat

Products

Amq Streams Apache Camel Hawtio Build Keycloak and 14 more

CVE-2026-91920

Undertow: undertow: chunkreader message length permits chunk-size overflow

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a specifically crafted 15-digit chunk size to bypass the limit and overflow into internal state flags. This can cause the server to terminate a request body prematurely and interpret the remaining data as a separate, smuggled request.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Camel Spring Boot Enterprise Linux Jboss Enterprise Application Platform and 3 more

CVE-2026-19879

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

A flaw was found in Undertow, an HTTP server, within its HTTP response header writing path. The `writeString()` method performs a silent narrowing cast from 16-bit Unicode characters to 8-bit bytes when writing HTTP response header values. A remote attacker can exploit this by supplying specific Unicode characters in user-controlled input that an application places into response headers. This can lead to the truncation of these characters into ASCII control characters or special symbols, potentially resulting in limited integrity impact or information disclosure if the application does not properly sanitize user input.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Build Of Apache Camel For Spring Boot Camel Spring Boot Enterprise Linux and 6 more