{"schemaVersion":3,"id":"SUSE-SU-2026:3482-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for netty, netty-tcnative\n\nThis update for netty, netty-tcnative fixes the following issues:\n\nUpgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.\n\nSecurity issues fixed\n\n- CVE-2026-44891: memory exhaustion in `io.netty:netty-codec-stomp` (bsc#1271435).\n- CVE-2026-55831: resource exhaustion/DoS in `io.netty:netty-codec-http` (bsc#1271960).\n- CVE-2026-55833: zip bomb in `io.netty:netty-codec-http` (bsc#1271961).\n- CVE-2026-55851: memory exhaustion in `io.netty:netty-codec-haproxy` (bsc#1272253).\n- CVE-2026-56745: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272254).\n- CVE-2026-56746: improper access control in `io.netty:netty-codec-http` (CORS) (bsc#1272255).\n- CVE-2026-56817: insecure defaults in XML parsing in `io.netty:netty-codec-xml` (bsc#1272257).\n- CVE-2026-56818: memory leak in `io.netty:netty-codec-redis` (bsc#1272603).\n- CVE-2026-56819: memory leak in `io.netty:netty-codec-http2` (bsc#1272258).\n- CVE-2026-56820: improper certificate validation in `io.netty:netty-handler-ssl-ocsp` (bsc#1272259).\n- CVE-2026-56821: improper certificate revocation check in `io.netty:netty-handler-ssl-ocsp` (bsc#1272299).\n- CVE-2026-56822: time-of-check/time-of-use in `io.netty:netty-handler-ssl-ocsp` (bsc#1272300).\n- CVE-2026-59898: protocol version confusion in `io.netty:netty-codec-http` (websocket) (bsc#1272302).\n- CVE-2026-59899: memory exhaustion in `io.netty:netty-codec-http` (bsc#1272301).\n- CVE-2026-59900: improper header neutralization in `io.netty:netty-codec-http2` (bsc#1272303).\n- CVE-2026-59901: infinite loop in `io.netty:netty-codec-compression` (bzip2) (bsc#1272304).\n- CVE-2026-59919: improper CR/LF neutralization in `io.netty:netty-codec-haproxy` (bsc#1272305).\n- CVE-2026-59920: improper CR/LF neutrolization in `io.netty:netty-codec-stomp` (bsc#1272306).\n- CVE-2026-59921: improper CR/LF neutralization in `io.netty:netty-codec-http` (multipart) (bsc#1272307).\n- Memory leak in `io.netty:netty-codec-dns`  (bsc#1272519).\n- Uncontrolled resource consumption in `io.netty:netty-codec-xml` (bsc#1272518).\n\nOther updates and bugfixes:\n\n- Upgrade to upstream version 4.1.136:\n  + SingleThreadEventExecutor: document Throwable safety contract\n    on run()\n  + Make HTTP/2 frame hashCode consistent with equals\n  + Add BlockHound exception for DnsQueryIdSpace (#16896)\n  + FlowControlHandler: Fix autoRead behavior\n  + Fix incorrect bounds in error message of\n    HpackDecoder.setMaxHeaderListSize\n  + MQTT: Fix MQTT decoder size check after variable header replay\n  + MQTT: Make the decodeProperties early-REPLAY check actually\n    fire\n  + Reject control characters at the boundary of HTTP method names\n    (#16723)\n  + Update to latest tcnative release\n  + Fix HTTP 2 PUSH_PROMISE stream association validation\n  + Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder\n  + Add opt-in validation of mandatory pseudo-header fields for\n    HTTP/2\n  + Strictly validate MQTT UTF-8 Encoded String (#16939)\n  + Stop DateFormatter trailing token from running past the parse\n    end\n  + IpFilter: Deprecate constructor which use accept by default\n  + Add RFC 10008 QUERY Method support (#16966)\n  + Correctly release and fail queued traffic-shaping writes on\n    close (#16959)\n  + FlowControlHandler: respect auto-read when toggled while\n    dequeueing\n  + IdleStateHandler: reset firstWriter/ReaderIdleEvent in\n    resetWriteTimeout/resetReadTimeout (#16982)\n  + Fix typo in AbstractSniHandler Javadoc\n  + Reconcile AbstractCoalescingBufferQueue readableBytes when it\n    drains, and fail stuck HTTP/2 streams instead of spinning\n    empty DATA frames\n  + Reject control characters at the boundary of the HTTP version\n    token (#16971)\n  + Reset UTF-8 decode state on CR in StompSubframeDecoder\n  + HTTP2: Pass the correct number of arguments when logging\n    goaway\n  + FastLz: Guard decompression against truncated input (#17000)\n  + Fix propagation of startTls for client SslContext handler\n  + Reject non-token characters in HTTP/2 header names\n  + Update lz4-java to 1.11.1\n  + Pin github actions to reduce risk (#17043)\n  + Merge branches from forks (#17063)","dates":{"published":"2026-08-04T11:46:42.000Z","modified":"2026-08-05T18:23:51.045Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Module for Development Tools 15 SP7","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP4-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP5-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server 15 SP6-LTSS","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP4","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP5","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","name":"netty-tcnative","label":"netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty-tcnative&distro=SUSE Linux Enterprise Server for SAP Applications 15 SP6","purlType":"rpm","versions":[{"text":"< 2.0.80-150200.3.48.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.0.80-150200.3.48.1","eol":null,"hubHref":null},{"vendor":"suse","product":"netty&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","name":"netty","label":"netty&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/netty&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7","purlType":"rpm","versions":[{"text":"< 4.1.136-150200.4.53.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.1.136-150200.4.53.1","eol":null,"hubHref":null}],"affectedCount":12,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263482-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-20263482-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1271435","label":"bugzilla.suse.com/1271435","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271960","label":"bugzilla.suse.com/1271960","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1271961","label":"bugzilla.suse.com/1271961","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272253","label":"bugzilla.suse.com/1272253","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272254","label":"bugzilla.suse.com/1272254","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272255","label":"bugzilla.suse.com/1272255","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272257","label":"bugzilla.suse.com/1272257","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272258","label":"bugzilla.suse.com/1272258","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272259","label":"bugzilla.suse.com/1272259","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272299","label":"bugzilla.suse.com/1272299","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272300","label":"bugzilla.suse.com/1272300","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272301","label":"bugzilla.suse.com/1272301","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272302","label":"bugzilla.suse.com/1272302","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272303","label":"bugzilla.suse.com/1272303","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272304","label":"bugzilla.suse.com/1272304","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272305","label":"bugzilla.suse.com/1272305","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272306","label":"bugzilla.suse.com/1272306","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272307","label":"bugzilla.suse.com/1272307","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272518","label":"bugzilla.suse.com/1272518","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272519","label":"bugzilla.suse.com/1272519","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1272603","label":"bugzilla.suse.com/1272603","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44891","label":"www.suse.com/security/cve/CVE-2026-44891","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55831","label":"www.suse.com/security/cve/CVE-2026-55831","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55833","label":"www.suse.com/security/cve/CVE-2026-55833","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55851","label":"www.suse.com/security/cve/CVE-2026-55851","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56745","label":"www.suse.com/security/cve/CVE-2026-56745","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56746","label":"www.suse.com/security/cve/CVE-2026-56746","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56817","label":"www.suse.com/security/cve/CVE-2026-56817","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56818","label":"www.suse.com/security/cve/CVE-2026-56818","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56819","label":"www.suse.com/security/cve/CVE-2026-56819","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56820","label":"www.suse.com/security/cve/CVE-2026-56820","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56821","label":"www.suse.com/security/cve/CVE-2026-56821","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-56822","label":"www.suse.com/security/cve/CVE-2026-56822","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59898","label":"www.suse.com/security/cve/CVE-2026-59898","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59899","label":"www.suse.com/security/cve/CVE-2026-59899","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59900","label":"www.suse.com/security/cve/CVE-2026-59900","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59901","label":"www.suse.com/security/cve/CVE-2026-59901","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59919","label":"www.suse.com/security/cve/CVE-2026-59919","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59920","label":"www.suse.com/security/cve/CVE-2026-59920","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59921","label":"www.suse.com/security/cve/CVE-2026-59921","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-44891","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56817","CVE-2026-56818","CVE-2026-56819","CVE-2026-56820","CVE-2026-56821","CVE-2026-56822","CVE-2026-59898","CVE-2026-59899","CVE-2026-59900","CVE-2026-59901","CVE-2026-59919","CVE-2026-59920","CVE-2026-59921"],"downstream":[],"duplicates":[],"related":["CVE-2026-44891","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56817","CVE-2026-56818","CVE-2026-56819","CVE-2026-56820","CVE-2026-56821","CVE-2026-56822","CVE-2026-59898","CVE-2026-59899","CVE-2026-59900","CVE-2026-59901","CVE-2026-59919","CVE-2026-59920","CVE-2026-59921"]},"timeline":[{"kind":"published","date":"2026-08-04T11:46:42.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-08-05T18:23:51.045Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T06:51:53.384Z","stale":false,"partial":false}}