Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (12 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-93566 1 Redhat 12 Amq Broker, Amq Clients, Apicurio Registry and 9 more 2026-09-18 6.5 Medium
### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch
CVE-2026-93565 1 Redhat 12 Amq Broker, Amq Clients, Apicurio Registry and 9 more 2026-09-18 7.5 High
### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with code point <= 0x20, the full range that `String.trim()` removes) before performing a cache lookup against its ten pre-populated method constants. A wire-delivered RTSP request whose method token ends with a trailing control byte — for example `PLAY\x00` or `PLAY\r`, immediately before the separating space — is decoded by `RtspDecoder` as a fully successful PLAY request, with `decoderResult().isSuccess() == true and request.method() == RtspMethods.PLAY` (same object reference as the cached singleton). The application layer cannot distinguish this from a clean `PLAY` request. This is the same root cause as #16723 and #16971, in a sibling that those fixes did not reach. The fix for `HttpMethod` hardened `HttpMethod.valueOf()` directly, but `RtspMethods.valueOf()` has its own independent `checkNonEmptyAfterTrim()` call that runs before the cache lookup — meaning a trailing-control-byte token hits the cache before the hardened `HttpMethod` constructor ever sees it. ### Reproduction Minimal wire-level reproduction Send the following raw bytes to any Netty-based RTSP server using R
CVE-2026-93564 1 Redhat 10 Amq Broker, Apicurio Registry, Build Keycloak and 7 more 2026-09-18 7.5 High
HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881)
CVE-2026-93558 1 Redhat 12 Amq Broker, Amq Clients, Apicurio Registry and 9 more 2026-09-18 7.5 High
Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service
CVE-2026-93578 1 Redhat 1 Camel Spring Boot 2026-09-18 5.9 Medium
Missing Extended Key Usage (EKU) check in OCSP Client allows certificate revocation bypass
CVE-2026-93560 1 Redhat 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more 2026-09-18 7.5 High
STOMP codec content-length long-to-int truncation causes infinite decode loop DoS
CVE-2026-93575 1 Redhat 5 Amq Broker, Camel Spring Boot, Jboss Enterprise Application Platform and 2 more 2026-09-18 7.5 High
### Summary Netty's fix for CVE-2026-44248 is incomplete. The decoder checks if the MQTT packet's `Remaining Length` exceeds `maxBytesInMessage`, but fails to validate the `Properties Length` against the `Remaining Length`. An attacker can bypass the size limit by sending a small `Remaining Length` but an enormous `Properties Length`. This forces Netty to buffer and parse millions of properties, allowing an unauthenticated remote attacker to trigger excessive memory and CPU consumption, leading to OutOfMemoryError. ### Details In `io.netty.handler.codec.mqtt.MqttDecoder`, the `decodeProperties()` helper method reads `totalPropertiesLength` and attempts to parse that many bytes. If the buffer lacks the full length, a `Signal` is thrown. The `catch` block inside `decode()` only enforces `maxBytesInMessage` against `bytesRemainingBeforeVariableHeader` (the packet's `Remaining Length`). By sending a `CONNECT` packet with a small `Remaining Length` but a huge `Properties Length`, the size check passes. `ReplayingDecoder` then buffers data from the network until the huge `Properties Length` is reached, parsing millions of `UserProperty` objects and exhausting CPU and memory. #
CVE-2026-93561 1 Redhat 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more 2026-09-18 6.5 Medium
Memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling
CVE-2026-93563 1 Redhat 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more 2026-09-18 7.5 High
Unbounded multi-line response accumulation in SmtpResponseDecoder leads to memory-exhaustion DoS
CVE-2026-93492 1 Redhat 11 Amq Broker, Apicurio Registry, Build Keycloak and 8 more 2026-09-18 5.3 Medium
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).
CVE-2026-93494 1 Redhat 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more 2026-09-18 7.5 High
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec.
CVE-2026-87283 1 Oracle 1 Vm Virtualbox 2026-09-17 6 Medium
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).