CVE-2026-45416

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Published Jun 12, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

netty

affected

Version	Status	Constraints
`>= 4.2.0.Final, < 4.2.15.Final`	affected	—
`< 4.1.135.Final`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:netty:netty::::::::
	cpe:2.3:a:netty:netty::::::::

No data.

Vendor Product Versions

Netty

Version	Status	Scheme	Platform
`[4.2.0.Final,4.2.15.Final)`	affected	generic	—
`[0,4.1.135.Final)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-x4gw-5cx5-pgmh	Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.921% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://access.redhat.com/errata/RHSA-2026:26017
https://access.redhat.com/errata/RHSA-2026:26018
https://access.redhat.com/errata/RHSA-2026:26586
https://access.redhat.com/errata/RHSA-2026:28573
https://access.redhat.com/errata/RHSA-2026:34608
https://access.redhat.com/errata/RHSA-2026:37390
https://access.redhat.com/errata/RHSA-2026:41951
https://access.redhat.com/errata/RHSA-2026:48151
https://access.redhat.com/errata/RHSA-2026:49700
https://access.redhat.com/errata/RHSA-2026:49701
https://access.redhat.com/errata/RHSA-2026:50085
https://access.redhat.com/errata/RHSA-2026:53644
https://access.redhat.com/errata/RHSA-2026:53645
https://access.redhat.com/errata/RHSA-2026:53646
https://access.redhat.com/errata/RHSA-2026:54435
https://access.redhat.com/errata/RHSA-2026:62260
https://access.redhat.com/errata/RHSA-2026:65126
https://access.redhat.com/errata/RHSA-2026:66488
https://access.redhat.com/errata/RHSA-2026:66545
https://access.redhat.com/security/cve/CVE-2026-45416
https://bugzilla.redhat.com/show_bug.cgi?id=2488391
https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh
https://nvd.nist.gov/vuln/detail/CVE-2026-45416
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json
https://www.cve.org/CVERecord?id=CVE-2026-45416

History

Sep 18, 2026 1:30 PM References updated View changes

Type	Values Removed	Values Added
References	https://access.redhat.com/errata/RHSA-2026:53806	https://access.redhat.com/errata/RHSA-2026:53645 https://access.redhat.com/errata/RHSA-2026:53646

Sep 11, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:66488 https://access.redhat.com/errata/RHSA-2026:66545

Sep 9, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:65126

Sep 2, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:62260

Aug 20, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:50085

Aug 13, 2026 1:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:54435

Aug 12, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://access.redhat.com/errata/RHSA-2026:53644 https://access.redhat.com/errata/RHSA-2026:53806

Jun 15, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-45416 https://www.cve.org/CVERecord?id=CVE-2026-45416
Metrics	threat_severity `None`	threat_severity `Important`

Jun 15, 2026 2:30 AM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:netty:netty::::::::

Jun 12, 2026 4:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Netty Netty netty
Vendors & Products		Netty Netty netty

Jun 12, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 12, 2026 2:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Title		Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
Weaknesses		CWE-770
References		https://github.com/netty/netty/releases/tag/netty-4.1.135.Final https://github.com/netty/netty/releases/tag/netty-4.2.15.Final https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Earlier changes (7)

Subscriptions

Netty Netty

Weaknesses

CWE-770

Sources

CVE record Updated: Sep 18, 2026, 12:04 PM

Status: PUBLISHED
Assigner: GitHub_M
Published: Jun 12, 2026, 2:10 PM
Updated: Sep 18, 2026, 12:04 PM
Reserved: May 12, 2026, 1:48 AM

View source JSON

Vulnrichment Updated: Sep 18, 2026, 12:04 PM

Updated: Sep 18, 2026, 12:04 PM

JSON

NVD Updated: Sep 18, 2026, 1:18 PM

Status: Modified
Published: Jun 12, 2026, 3:16 PM
Modified: Sep 18, 2026, 1:18 PM

View source JSON

Red Hat Updated: Jun 12, 2026, 2:10 PM

Severity: Important
Public date: Jun 12, 2026, 2:10 PM

View source Bugzilla JSON

OpenCVE enrichment Updated: Jun 12, 2026, 4:00 PM

Updated: Jun 12, 2026, 4:00 PM

JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45416", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-12T01:48:40.452Z", "datePublished": "2026-06-12T14:10:05.585Z", "dateUpdated": "2026-09-18T12:04:45.683Z"}, "containers": {"cna": {"title": "Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"}, {"name": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "tags": ["x_refsource_MISC"], "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"}, {"name": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "tags": ["x_refsource_MISC"], "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"}], "affected": [{"vendor": "netty", "product": "netty", "versions": [{"version": ">= 4.2.0.Final, < 4.2.15.Final", "status": "affected"}, {"version": "< 4.1.135.Final", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T14:12:09.426Z"}, "descriptions": [{"lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}], "source": {"advisory": "GHSA-x4gw-5cx5-pgmh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-12T15:06:59.768657Z", "id": "CVE-2026-45416", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T15:07:07.365Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/cryostat-reports-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-13", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/cryostat-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-13", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/jfr-datasource-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-13", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_broker:7.13"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat AMQ Broker 7.13.6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_broker:7.14"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat AMQ Broker 7.14.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:quarkus:3.27::el8"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat build of Quarkus 3.27.4.SP1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:quarkus:3.33::el8"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat build of Quarkus 3.33.2.SP1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat Data Grid 8.6.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat JBoss Enterprise Application Platform 8.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform::el7"], "defaultStatus": "affected", "packageName": "io.netty/netty-handler", "product": "Red Hat JBoss Enterprise Application Platform 8.1.7.GA", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.1.135.Final-redhat-00001", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:801.7.1-1.GA_redhat_00001.1.el10eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "defaultStatus": "affected", "packageName": "eap8-netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el10eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "defaultStatus": "affected", "packageName": "eap8-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el10eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.1.7.1-1.GA_redhat_00004.1.el10eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:801.7.1-1.GA_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-jose4j", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:0.9.6-2.redhat_00002.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.1.7.1-1.GA_redhat_00004.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:801.7.1-1.GA_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-jose4j", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:0.9.6-2.redhat_00002.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.1.7.1-1.GA_redhat_00004.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:2.9::el9"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Streams for Apache Kafka 2.9.4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:3.2::el9"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Streams for Apache Kafka 3.2.1", "vendor": "Red Hat"}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:offline_knowledge_portal:1.2::el9"], "defaultStatus": "affected", "packageName": "offline-knowledge-portal/rhokp-rhel9", "product": "Red Hat Offline Knowledge Portal 1.2.12", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782239370", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-trustyai-service-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1788198681", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3.30::el9"], "defaultStatus": "affected", "packageName": "devspaces/openvsx-rhel9", "product": "Red Hat OpenShift Dev Spaces 3.30", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787759145", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3.30::el9"], "defaultStatus": "affected", "packageName": "devspaces/pluginregistry-rhel9", "product": "Red Hat OpenShift Dev Spaces 3.30", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787759723", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_clients:2023"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat AMQ Clients", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:camel_quarkus:3"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat build of Apicurio Registry 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:debezium:3"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat build of Debezium 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9-operator", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "unaffected", "packageName": "bazel6", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "unaffected", "packageName": "bazel7", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "unaffected", "packageName": "bazel8", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-modelmesh-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-openvino-model-server-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-spark-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "affected", "packageName": "devspaces/jetbrains-ide-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "unaffected", "packageName": "devspaces/multicluster-redirector-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "unaffected", "packageName": "devspaces/server-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "unaffected", "packageName": "candlepin", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "unaffected", "packageName": "satellite:el8/candlepin", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "datePublic": "2026-06-12T14:10:05.585Z", "descriptions": [{"lang": "en", "value": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-45416"}, {"name": "RHBZ#2488391", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:49700"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:53644"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:53645"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:48151"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:53646"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:66545"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:66488"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:26586"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:41951"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:50085"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:49701"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:28573"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:65126"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:62260"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:37390"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:26018"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:26017"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:34608"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:54435"}], "solutions": [{"lang": "en", "value": "RHSA-2026:49700: Red Hat JBoss EAP 8.1 for RHEL 10, Red Hat JBoss EAP 8.1 for RHEL 8, Red Hat JBoss EAP 8.1 for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"}, {"lang": "en", "value": "RHSA-2026:53645: Red Hat JBoss EAP 7.4 ELS for RHEL 8"}, {"lang": "en", "value": "RHSA-2026:48151: Cryostat 4 on RHEL 9"}, {"lang": "en", "value": "RHSA-2026:53646: Red Hat JBoss EAP 7.4 ELS for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:66545: Red Hat AMQ Broker 7.13.6"}, {"lang": "en", "value": "RHSA-2026:66488: Red Hat AMQ Broker 7.14.1"}, {"lang": "en", "value": "RHSA-2026:26586: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1"}, {"lang": "en", "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"}, {"lang": "en", "value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"}, {"lang": "en", "value": "RHSA-2026:49701: Red Hat JBoss Enterprise Application Platform 8.1.7.GA"}, {"lang": "en", "value": "RHSA-2026:28573: Red Hat Offline Knowledge Portal 1.2.12"}, {"lang": "en", "value": "RHSA-2026:65126: Red Hat OpenShift AI 2.25"}, {"lang": "en", "value": "RHSA-2026:62260: Red Hat OpenShift Dev Spaces 3.30"}, {"lang": "en", "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"}, {"lang": "en", "value": "RHSA-2026:26018: Red Hat build of Quarkus 3.27.4.SP1"}, {"lang": "en", "value": "RHSA-2026:26017: Red Hat build of Quarkus 3.33.2.SP1"}, {"lang": "en", "value": "RHSA-2026:34608: Streams for Apache Kafka 2.9.4"}, {"lang": "en", "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"}], "timeline": [{"lang": "en", "time": "2026-06-12T15:01:45.671Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-12T14:10:05.585Z", "value": "Made public."}], "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "workarounds": [{"lang": "en", "value": "To mitigate this issue, configure applications utilizing Netty's `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application's documentation for details on configuring Netty's TLS handler. A restart of the affected application or service is required for the configuration changes to take effect."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-18T12:04:45.683Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:cryostat:4::el9"], "vendor": "Red Hat", "product": "Cryostat 4 on RHEL 9", "versions": [{"status": "unaffected", "version": "4.2.0-13", "lessThan": "*", "versionType": "rpm"}], "packageName": "cryostat/cryostat-reports-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cryostat:4::el9"], "vendor": "Red Hat", "product": "Cryostat 4 on RHEL 9", "versions": [{"status": "unaffected", "version": "4.2.0-13", "lessThan": "*", "versionType": "rpm"}], "packageName": "cryostat/cryostat-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cryostat:4::el9"], "vendor": "Red Hat", "product": "Cryostat 4 on RHEL 9", "versions": [{"status": "unaffected", "version": "4.2.0-13", "lessThan": "*", "versionType": "rpm"}], "packageName": "cryostat/jfr-datasource-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:amq_broker:7.13"], "vendor": "Red Hat", "product": "Red Hat AMQ Broker 7.13.6", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:amq_broker:7.14"], "vendor": "Red Hat", "product": "Red Hat AMQ Broker 7.14.1", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"], "vendor": "Red Hat", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:quarkus:3.27::el8"], "vendor": "Red Hat", "product": "Red Hat build of Quarkus 3.27.4.SP1", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:quarkus:3.33::el8"], "vendor": "Red Hat", "product": "Red Hat build of Quarkus 3.33.2.SP1", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "vendor": "Red Hat", "product": "Red Hat Data Grid 8.6.2", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-glassfish-jsf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-ironjacamar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-remoting", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-bindings", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-federation", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "versions": [{"status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-glassfish-jsf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-ironjacamar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-remoting", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-bindings", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-federation", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "versions": [{"status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-activemq-artemis", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-glassfish-jsf", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-ironjacamar", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-annotations", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-core", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-databind", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-jaxrs-providers", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-base", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jackson-modules-java8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-remoting", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-jboss-server-migration", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-bindings", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-picketlink-federation", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-undertow", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "versions": [{"status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap7-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform::el7"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1.7.GA", "versions": [{"status": "unaffected", "version": "4.1.135.Final-redhat-00001", "lessThan": "*", "versionType": "rpm"}], "packageName": "io.netty/netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "versions": [{"status": "unaffected", "version": "0:801.7.1-1.GA_redhat_00001.1.el10eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-eap-product-conf-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el10eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el10eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "versions": [{"status": "unaffected", "version": "0:8.1.7.1-1.GA_redhat_00004.1.el10eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:801.7.1-1.GA_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-eap-product-conf-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:0.9.6-2.redhat_00002.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-jose4j", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "versions": [{"status": "unaffected", "version": "0:8.1.7.1-1.GA_redhat_00004.1.el8eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:801.7.1-1.GA_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-eap-product-conf-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:0.9.6-2.redhat_00002.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-jose4j", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-netty", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-netty-transport-native-epoll", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "versions": [{"status": "unaffected", "version": "0:8.1.7.1-1.GA_redhat_00004.1.el9eap", "lessThan": "*", "versionType": "rpm"}], "packageName": "eap8-wildfly", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:amq_streams:2.9::el9"], "vendor": "Red Hat", "product": "Streams for Apache Kafka 2.9.4", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:amq_streams:3.2::el9"], "vendor": "Red Hat", "product": "Streams for Apache Kafka 3.2.1", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:offline_knowledge_portal:1.2::el9"], "vendor": "Red Hat", "product": "Red Hat Offline Knowledge Portal 1.2.12", "versions": [{"status": "unaffected", "version": "1782239370", "lessThan": "*", "versionType": "rpm"}], "packageName": "offline-knowledge-portal/rhokp-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.25", "versions": [{"status": "unaffected", "version": "1788198681", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-trustyai-service-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3.30::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces 3.30", "versions": [{"status": "unaffected", "version": "1787759145", "lessThan": "*", "versionType": "rpm"}], "packageName": "devspaces/openvsx-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3.30::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces 3.30", "versions": [{"status": "unaffected", "version": "1787759723", "lessThan": "*", "versionType": "rpm"}], "packageName": "devspaces/pluginregistry-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:serverless:1"], "vendor": "Red Hat", "product": "OpenShift Serverless", "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:amq_clients:2023"], "vendor": "Red Hat", "product": "Red Hat AMQ Clients", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:camel_quarkus:3"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "vendor": "Red Hat", "product": "Red Hat build of Apache Camel - HawtIO 4", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:apicurio_registry:3"], "vendor": "Red Hat", "product": "Red Hat build of Apicurio Registry 3", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:debezium:3"], "vendor": "Red Hat", "product": "Red Hat build of Debezium 3", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "rhbk/keycloak-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "rhbk/keycloak-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:build_keycloak:"], "vendor": "Red Hat", "product": "Red Hat Build of Keycloak", "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "bazel6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "bazel7", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "packageName": "bazel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jboss_fuse:7"], "vendor": "Red Hat", "product": "Red Hat Fuse 7", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-modelmesh-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-openvino-model-server-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-spark-operator-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces", "packageName": "devspaces/jetbrains-ide-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces", "packageName": "devspaces/multicluster-redirector-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces", "packageName": "devspaces/server-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "candlepin", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:satellite:6"], "vendor": "Red Hat", "product": "Red Hat Satellite 6", "packageName": "satellite:el8/candlepin", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "vendor": "Red Hat", "product": "Red Hat Single Sign-On 7", "packageName": "netty-handler", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-06-12T15:01:45.671Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-06-12T14:10:05.585Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:49700: Red Hat JBoss EAP 8.1 for RHEL 10, Red Hat JBoss EAP 8.1 for RHEL 8, Red Hat JBoss EAP 8.1 for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"}, {"lang": "en", "value": "RHSA-2026:53645: Red Hat JBoss EAP 7.4 ELS for RHEL 8"}, {"lang": "en", "value": "RHSA-2026:48151: Cryostat 4 on RHEL 9"}, {"lang": "en", "value": "RHSA-2026:53646: Red Hat JBoss EAP 7.4 ELS for RHEL 9"}, {"lang": "en", "value": "RHSA-2026:66545: Red Hat AMQ Broker 7.13.6"}, {"lang": "en", "value": "RHSA-2026:66488: Red Hat AMQ Broker 7.14.1"}, {"lang": "en", "value": "RHSA-2026:26586: Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1"}, {"lang": "en", "value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"}, {"lang": "en", "value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"}, {"lang": "en", "value": "RHSA-2026:49701: Red Hat JBoss Enterprise Application Platform 8.1.7.GA"}, {"lang": "en", "value": "RHSA-2026:28573: Red Hat Offline Knowledge Portal 1.2.12"}, {"lang": "en", "value": "RHSA-2026:65126: Red Hat OpenShift AI 2.25"}, {"lang": "en", "value": "RHSA-2026:62260: Red Hat OpenShift Dev Spaces 3.30"}, {"lang": "en", "value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"}, {"lang": "en", "value": "RHSA-2026:26018: Red Hat build of Quarkus 3.27.4.SP1"}, {"lang": "en", "value": "RHSA-2026:26017: Red Hat build of Quarkus 3.33.2.SP1"}, {"lang": "en", "value": "RHSA-2026:34608: Streams for Apache Kafka 2.9.4"}, {"lang": "en", "value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"}], "x_adpType": "supplier", "datePublic": "2026-06-12T14:10:05.585Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-45416", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391", "name": "RHBZ#2488391", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:49700", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53644", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53645", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:48151", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:53646", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:66545", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:66488", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:26586", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:41951", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:50085", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:49701", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:28573", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:65126", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:62260", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:37390", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:26018", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:26017", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:34608", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:54435", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "To mitigate this issue, configure applications utilizing Netty's `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application's documentation for details on configuring Netty's TLS handler. A restart of the affected application or service is required for the configuration changes to take effect."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-18T12:04:45.683Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45416", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T15:06:59.768657Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-12T15:07:02.643Z"}}], "cna": {"title": "Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes", "source": {"advisory": "GHSA-x4gw-5cx5-pgmh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "netty", "product": "netty", "versions": [{"status": "affected", "version": ">= 4.2.0.Final, < 4.2.15.Final"}, {"status": "affected", "version": "< 4.1.135.Final"}]}], "references": [{"url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh", "name": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "name": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "name": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-12T14:12:09.426Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45416", "state": "PUBLISHED", "dateUpdated": "2026-09-18T12:04:45.683Z", "dateReserved": "2026-05-12T01:48:40.452Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-12T14:10:05.585Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "netty", "vendor": "netty", "versions": [{"status": "affected", "version": ">= 4.2.0.Final, < 4.2.15.Final"}, {"status": "affected", "version": "< 4.1.135.Final"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/cryostat-reports-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-13", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/cryostat-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-13", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/jfr-datasource-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-13", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_broker:7.13"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat AMQ Broker 7.13.6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_broker:7.14"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat AMQ Broker 7.14.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_quarkus:3.33"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_spring_boot:4.18"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:quarkus:3.27::el8"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat build of Quarkus 3.27.4.SP1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:quarkus:3.33::el8"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat build of Quarkus 3.33.2.SP1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_data_grid:8"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat Data Grid 8.6.2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el7eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-activemq-artemis", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.16.0-22.redhat_00057.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-glassfish-jsf", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-ironjacamar", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.5.26-2.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-annotations", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-core", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-databind", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-jaxrs-providers", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-base", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jackson-modules-java8", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.18.8-1.redhat_00003.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-remoting", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-jboss-server-migration", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:1.10.0-46.Final_redhat_00044.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-bindings", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-picketlink-federation", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-undertow", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"], "defaultStatus": "affected", "packageName": "eap7-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:7.4.25-2.GA_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat JBoss Enterprise Application Platform 8.1", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform::el7"], "defaultStatus": "affected", "packageName": "io.netty/netty-handler", "product": "Red Hat JBoss Enterprise Application Platform 8.1.7.GA", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.1.135.Final-redhat-00001", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:801.7.1-1.GA_redhat_00001.1.el10eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "defaultStatus": "affected", "packageName": "eap8-netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el10eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "defaultStatus": "affected", "packageName": "eap8-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el10eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el10"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.1.7.1-1.GA_redhat_00004.1.el10eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:801.7.1-1.GA_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-jose4j", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:0.9.6-2.redhat_00002.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el8"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.1.7.1-1.GA_redhat_00004.1.el8eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-eap-product-conf-parent", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:801.7.1-1.GA_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-jose4j", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:0.9.6-2.redhat_00002.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-netty", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-netty-transport-native-epoll", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:4.1.135-1.Final_redhat_00001.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"], "defaultStatus": "affected", "packageName": "eap8-wildfly", "product": "Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:8.1.7.1-1.GA_redhat_00004.1.el9eap", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:2.9::el9"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Streams for Apache Kafka 2.9.4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_streams:3.2::el9"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Streams for Apache Kafka 3.2.1", "vendor": "Red Hat"}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:offline_knowledge_portal:1.2::el9"], "defaultStatus": "affected", "packageName": "offline-knowledge-portal/rhokp-rhel9", "product": "Red Hat Offline Knowledge Portal 1.2.12", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782239370", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.25::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-trustyai-service-rhel9", "product": "Red Hat OpenShift AI 2.25", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1788198681", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3.30::el9"], "defaultStatus": "affected", "packageName": "devspaces/openvsx-rhel9", "product": "Red Hat OpenShift Dev Spaces 3.30", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787759145", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3.30::el9"], "defaultStatus": "affected", "packageName": "devspaces/pluginregistry-rhel9", "product": "Red Hat OpenShift Dev Spaces 3.30", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1787759723", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:serverless:1"], "defaultStatus": "affected", "packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "product": "OpenShift Serverless", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:amq_clients:2023"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat AMQ Clients", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:camel_quarkus:3"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat build of Apache Camel 4 for Quarkus 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apache_camel_hawtio:4"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat build of Apache Camel - HawtIO 4", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:apicurio_registry:3"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat build of Apicurio Registry 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:debezium:3"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat build of Debezium 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "rhbk/keycloak-rhel9-operator", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:build_keycloak:"], "defaultStatus": "affected", "packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator", "product": "Red Hat Build of Keycloak", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "unaffected", "packageName": "bazel6", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "unaffected", "packageName": "bazel7", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux_ai:3"], "defaultStatus": "unaffected", "packageName": "bazel8", "product": "Red Hat Enterprise Linux AI (RHEL AI) 3", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_fuse:7"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat Fuse 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "affected", "packageName": "netty-handler", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-modelmesh-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-openvino-model-server-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-spark-operator-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "affected", "packageName": "devspaces/jetbrains-ide-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "unaffected", "packageName": "devspaces/multicluster-redirector-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "unaffected", "packageName": "devspaces/server-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "unaffected", "packageName": "candlepin", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:satellite:6"], "defaultStatus": "unaffected", "packageName": "satellite:el8/candlepin", "product": "Red Hat Satellite 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:red_hat_single_sign_on:7"], "defaultStatus": "unaffected", "packageName": "netty-handler", "product": "Red Hat Single Sign-On 7", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "matchCriteriaId": "3097D962-A32D-4467-AAE7-F4CBA3A349D2", "versionEndExcluding": "4.1.135", "vulnerable": true}, {"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "matchCriteriaId": "413D4611-A46C-4BE4-AB2F-D86282F65984", "versionEndExcluding": "4.2.15", "versionStartIncluding": "4.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue."}], "id": "CVE-2026-45416", "lastModified": "2026-09-18T13:18:25.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45416", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-12T15:06:59.768657Z", "version": "2.0.3"}}]}, "published": "2026-06-12T15:16:26.940", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:26017"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:26018"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:26586"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:28573"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:34608"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:37390"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:41951"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:48151"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:49700"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:49701"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:50085"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:53644"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:53645"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:53646"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:54435"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:62260"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:65126"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:66488"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:66545"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-45416"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-770"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "id": "2488391", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488391"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.", "A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a crafted TLS (Transport Layer Security) ClientHello message. This can lead to an eager allocation of a large memory buffer, causing a Denial of Service (DoS) due to excessive memory consumption. The issue occurs in the `SslClientHelloHandler.decode()` method when processing the TLS handshake length."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, configure applications utilizing Netty's `SslClientHelloHandler` to specify a non-zero value for the `maxClientHelloLength` parameter. This will enable the internal length validation, preventing the eager allocation of large memory buffers when processing crafted TLS ClientHello messages. Refer to your specific application's documentation for details on configuring Netty's TLS handler. A restart of the affected application or service is required for the configuration changes to take effect."}, "name": "CVE-2026-45416", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-ekb-dispatcher-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-ekb-receiver-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:serverless:1", "fix_state": "Affected", "package_name": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9", "product_name": "OpenShift Serverless"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:amq_clients:2023", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat AMQ Clients"}, {"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Will not fix", "package_name": "netty-handler", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "rhbk/keycloak-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "rhbk/keycloak-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "rhbk-openshift-rhel9/rhbk-openshift-rhel9", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:build_keycloak:", "fix_state": "Affected", "package_name": "rhbk-rhel9-operator/rhbk-rhel9-operator", "product_name": "Red Hat Build of Keycloak"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "bazel6", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "bazel7", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Not affected", "package_name": "bazel8", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Affected", "package_name": "offline-knowledge-portal/rhokp-rhel9", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-modelmesh-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-trustyai-service-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/jetbrains-ide-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/multicluster-redirector-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/server-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "candlepin", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "satellite:el8/candlepin", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:red_hat_single_sign_on:7", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "Red Hat Single Sign-On 7"}, {"cpe": "cpe:/a:redhat:amq_streams:2", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "streams for Apache Kafka 2"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Affected", "package_name": "netty-handler", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-06-12T14:10:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-45416\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45416\nhttps://github.com/netty/netty/releases/tag/netty-4.1.135.Final\nhttps://github.com/netty/netty/releases/tag/netty-4.2.15.Final\nhttps://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh"], "statement": "This vulnerability in Netty is rated as Important. It allows a remote attacker to trigger a denial of service by sending a specially crafted TLS ClientHello message. The flaw arises from an eager, unbounded memory allocation during the TLS handshake, particularly when default configurations disable the maximum client hello length guard, leading to excessive resource consumption in affected Red Hat products utilizing Netty.", "threat_severity": "Important"}

Affected Products

Remediation

Tracking

Advisories

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

Sources

JSON object

JSON object

JSON object

JSON object

JSON object