SUSE-SU-2026:1353-1: netty-tcnative&distro=openSUSE Leap 15.6

Vulnerability summary

SUSE-SU-2026:1353-1 is a vulnerability in netty-tcnative&distro=openSUSE Leap 15.6 with no CVSS score yet.

Timeline

1. 15-04-2026
   PublishedVulnerability first disclosed.
2. 16-04-2026
   Last modifiedVulnerability information updated.

Description

Security update for netty, netty-tcnative This update for netty, netty-tcnative fixes the following issues: Upidate to 4.1.132: - CVE-2026-33870: incorrectly parses quoted strings in HTTP/1.1 can lead to request smuggling (bsc#1261031). - CVE-2026-33871: sending a flood of CONTINUATION frames can lead to a denial of service (bsc#1261043). Changelog: - Upgrade to upstream version 4.1.132 * Fixes: + Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry loop + Make RefCntOpenSslContext.deallocate more robust + HTTP2: Correctly account for padding when decompress + Fix high-order bit aliasing in HttpUtil.validateToken + fix: the precedence of + is higher than >> + AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater than byteBuf.maxCapacity() + AdaptivePoolingAllocator: call unreserveMatchingBuddy(...) if byteBuf initialization failed + Don't assume CertificateFactory is thread-safe + Fix HttpObjectAggregator leaving connection stuck after 413 with AUTO_READ=false + HTTP2: Ensure preface is flushed in all cases + Fix UnsupportedOperationException in readTrailingHeaders + Fix client_max_window_bits parameter handling in permessage-deflate extension + Native transports: Fix possible fd leak when fcntl fails. + Kqueue: Fix undefined behaviour when GetStringUTFChars fails and SO_ACCEPTFILTER is supported + Kqueue: Possible overflow when using netty_kqueue_bsdsocket_setAcceptFilter(...) + Native transports: Fix undefined behaviour when GetStringUTFChars fails while open FD + Epoll: Add null checks for safety reasons + Epoll: Use correct value to initialize mmsghdr.msg_namelen + Epoll: Fix support for IP_RECVORIGDSTADDR + AdaptivePoolingAllocator: remove ensureAccessible() call in capacity(int) method + Epoll: setTcpMg5Sig(...) might overflow + JdkZlibDecoder: accumulate decompressed output before firing channelRead + Limit the number of Continuation frames per HTTP2 Headers (bsc#1261043, CVE-2026-33871) + Stricter HTTP/1.1 chunk extension parsing (bsc#1261031, CVE-2026-33870) + rediff - Upgrade to upstream version 4.1.131 + NioDatagramChannel.block(...) does not early return on failure + Support for AWS Libcrypto (AWS-LC) netty-tcnative build + codec-dns: Decompress MX RDATA exchange domain names during DNS record decoding + Buddy allocation for large buffers in adaptive allocator + SslHandler: Only resume on EventLoop if EventLoop is not shutting down already + Wrap ECONNREFUSED in PortUnreachableException for UDP + Bump com.ning:compress-lzf (4.1) + Fix adaptive allocator bug from not noticing failed allocation + Avoid loosing original read exception + Backport multiple adaptive allocator changes - Upgrade to version 4.1.130 - Upgrade to version 2.0.75 Final * No formal changelog present * Needed by netty >= 4.2.11

No weakness data has been published for this record.