{"schemaVersion":3,"id":"SUSE-SU-2026:2802-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for netty, netty-tcnative\n\nThis update for netty, netty-tcnative fixes the following issue\n\nThis update for netty, netty-tcnative fixes the following issues\n\nUpgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:\n\n- CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).\n- CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).\n- CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).\n- CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).\n- CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).\n- CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).\n- CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).\n- CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).\n- CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments\n  (bsc#1268250).\n- CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).\n- CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).\n- CVE-2026-48006: netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in\n  RedisArrayAggregator (bsc#1268255).\n- CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).\n- CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers\n  (bsc#1268258).\n- CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).\n- CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).\n- CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are\n  permitted (bsc#1268261).\n- CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (bsc#1268262).\n\nChanges:\n\n + MQTT: Allow MQTT 5 CONNECT with password only\n + ChannelInitializer: correct misleading comment on\n exceptionCaught route\n + HTTP/2: Parse request-target path like Vert.x (4.1 backport)\n + HttpObjectDecoder skips arbitrary initial control characters\n when only initial CRLF characters are permitted\n + IpSubnetFilter: Correctly handle ipv6\n + Configurable bound on RedisArrayAggregator\n + Redis: Limit decoded length\n + DNS: Ensure query id is not predictible\n + Wrapping plain trust manager silently disables hostname\n verification\n + MQTT: Reject malformed no-payload packets with non-zero\n Remaining Length\n + HAProxy: Reject HAProxyMessages with malformated TLV and not\n leak memory\n + SSL: Use sane defaults as limits for the client hello length\n and timeout\n + DNS: Only cache CNAME if part of the queried domain\n + HTTP/2: Enforce max concurrent streams for misbehaving clients\n + Dns: Insufficient Bailiwick Validation for NS Records\n + HTTP2: DelegatingDecompressorFrameListener must release memory\n in all cases\n + Pass maxAllocation to Brotli and Zstd decoders\n + HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory\n + Add maxWindowLog parameter to ZstdDecoder to bound memory\n allocation\n + HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs\n + Epoll / Kqueue: Correctly handle receive of FD\n + SCTP: Limit the number of inflight incomplete SCTP messages\n and the number of fragments\n + Redis: Correctly release incomplete message on removal when\n using RedisArrayAggregator\n + Redis: Limit the maximum number of nested arrays\n + HTTP: Re-add constructor to HttpProxyHandler that was removed\n by mistake\n + Marshalling: Explicit document security requirements\n + Pin HTTP/RTSP version + method normalization to Locale.US\n + Adaptive: Fix concurrency issue in adaptive allocator\n + Pin multipart Content-Type / Content-Transfer-Encoding case\n folding to Locale.US\n + Remove dead native declarations\n + Avoid re-parsing openssl key material with non-cached provider\n + IpFilter: Fix ClassCastException caused by IpSubnetFilter if\n only ipv6 rules are configured but remote peer is using ipv4\n + Resolve all localhost addresses without querying DNS servers\n + HTTP2: Use 100 as default max concurrent streams setting\n + Route synchronous onLookupComplete exceptions via\n fireExceptionCaught\n + Fix MQTT decoder size check after variable header replay","dates":{"published":"2026-07-08T19:06:43.000Z","modified":"2026-07-09T10:00:04.595Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 2.0.79-150200.3.45.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.79-150200.3.45.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","name":"netty","label":"netty&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","purlType":"rpm","versions":[{"text":"< 4.1.135-150200.4.50.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.1.135-150200.4.50.1","eol":null,"hubHref":null}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262802-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20262802-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1268165","label":"bugzilla.suse.com/1268165","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268169","label":"bugzilla.suse.com/1268169","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268170","label":"bugzilla.suse.com/1268170","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268244","label":"bugzilla.suse.com/1268244","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268246","label":"bugzilla.suse.com/1268246","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268247","label":"bugzilla.suse.com/1268247","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268248","label":"bugzilla.suse.com/1268248","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268249","label":"bugzilla.suse.com/1268249","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268250","label":"bugzilla.suse.com/1268250","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268251","label":"bugzilla.suse.com/1268251","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268252","label":"bugzilla.suse.com/1268252","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268255","label":"bugzilla.suse.com/1268255","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268257","label":"bugzilla.suse.com/1268257","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268258","label":"bugzilla.suse.com/1268258","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268259","label":"bugzilla.suse.com/1268259","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268260","label":"bugzilla.suse.com/1268260","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268261","label":"bugzilla.suse.com/1268261","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1268262","label":"bugzilla.suse.com/1268262","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44249","label":"www.suse.com/security/cve/CVE-2026-44249","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44250","label":"www.suse.com/security/cve/CVE-2026-44250","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44890","label":"www.suse.com/security/cve/CVE-2026-44890","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44893","label":"www.suse.com/security/cve/CVE-2026-44893","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45416","label":"www.suse.com/security/cve/CVE-2026-45416","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45536","label":"www.suse.com/security/cve/CVE-2026-45536","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45673","label":"www.suse.com/security/cve/CVE-2026-45673","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45674","label":"www.suse.com/security/cve/CVE-2026-45674","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46340","label":"www.suse.com/security/cve/CVE-2026-46340","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47244","label":"www.suse.com/security/cve/CVE-2026-47244","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-47691","label":"www.suse.com/security/cve/CVE-2026-47691","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48006","label":"www.suse.com/security/cve/CVE-2026-48006","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48043","label":"www.suse.com/security/cve/CVE-2026-48043","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48059","label":"www.suse.com/security/cve/CVE-2026-48059","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50010","label":"www.suse.com/security/cve/CVE-2026-50010","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50011","label":"www.suse.com/security/cve/CVE-2026-50011","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50020","label":"www.suse.com/security/cve/CVE-2026-50020","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-50560","label":"www.suse.com/security/cve/CVE-2026-50560","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-44249","CVE-2026-44250","CVE-2026-44890","CVE-2026-44893","CVE-2026-45416","CVE-2026-45536","CVE-2026-45673","CVE-2026-45674","CVE-2026-46340","CVE-2026-47244","CVE-2026-47691","CVE-2026-48006","CVE-2026-48043","CVE-2026-48059","CVE-2026-50010","CVE-2026-50011","CVE-2026-50020","CVE-2026-50560"],"downstream":[],"duplicates":[],"related":["CVE-2026-44249","CVE-2026-44250","CVE-2026-44890","CVE-2026-44893","CVE-2026-45416","CVE-2026-45536","CVE-2026-45673","CVE-2026-45674","CVE-2026-46340","CVE-2026-47244","CVE-2026-47691","CVE-2026-48006","CVE-2026-48043","CVE-2026-48059","CVE-2026-50010","CVE-2026-50011","CVE-2026-50020","CVE-2026-50560"]},"timeline":[{"kind":"published","date":"2026-07-08T19:06:43.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-09T10:00:04.595Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T22:33:44.715Z","stale":false,"partial":false}}