RHLW-2026-1caafb676cc0f4c9
- Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-1caafb676cc0f4c9.json
- Import Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-1caafb676cc0f4c9.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/RHLW-2026-1caafb676cc0f4c9
- Upstream
CVE (8)
- Published
- 2026-10-12T16:57:35Z
- Modified
- 2026-10-22T00:08:21Z
- Severity
-
- 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Lightwell Security Advisory: netty-codec-http2 4.1.100.Final-rhlw-00001
- Details
-
Red Hat Lightwell has released io.netty:netty-codec-http2 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-55163, CVE-2026-33871, CVE-2026-42587, CVE-2026-47244, CVE-2026-48043, CVE-2026-50560, CVE-2026-56819, and CVE-2026-59900.
CVE-2025-55163: Netty MadeYouReset HTTP/2 DDoS Vulnerability
CVE-2026-33871: Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
CVE-2026-42587: Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
CVE-2026-47244: Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
CVE-2026-48043: netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
CVE-2026-56819: Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
CVE-2026-59900: Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
This patched artifact is a drop-in replacement for io.netty:netty-codec-http2 4.1.100.Final from Maven Central.
- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55163.json
- https://github.com/netty/netty/security/advisories/GHSA-prj3-ccx8-p6x4
- https://nvd.nist.gov/vuln/detail/CVE-2025-55163
- https://github.com/advisories/GHSA-prj3-ccx8-p6x4
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33871.json
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:10184
- https://access.redhat.com/errata/RHSA-2026:13571
- https://access.redhat.com/errata/RHSA-2026:14272
- https://access.redhat.com/errata/RHSA-2026:14276
- https://access.redhat.com/errata/RHSA-2026:17668
- https://access.redhat.com/errata/RHSA-2026:17789
- https://access.redhat.com/errata/RHSA-2026:18054
- https://access.redhat.com/errata/RHSA-2026:18055
- https://access.redhat.com/errata/RHSA-2026:18059
- https://access.redhat.com/errata/RHSA-2026:22619
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:7109
- https://access.redhat.com/errata/RHSA-2026:7380
- https://access.redhat.com/errata/RHSA-2026:8159
- https://access.redhat.com/errata/RHSA-2026:8509
- https://access.redhat.com/security/cve/CVE-2026-33871
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33871.json
- https://github.com/netty/netty/security/advisories/GHSA-w9fj-cfpg-grvv
- https://nvd.nist.gov/vuln/detail/CVE-2026-33871
- https://github.com/advisories/GHSA-w9fj-cfpg-grvv
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json
- https://access.redhat.com/errata/RHSA-2026:23808
- https://access.redhat.com/errata/RHSA-2026:24502
- https://access.redhat.com/errata/RHSA-2026:25123
- https://access.redhat.com/errata/RHSA-2026:28010
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:42644
- https://access.redhat.com/errata/RHSA-2026:49700
- https://access.redhat.com/errata/RHSA-2026:49701
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/security/cve/CVE-2026-42587
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42587.json
- https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv
- https://nvd.nist.gov/vuln/detail/CVE-2026-42587
- https://github.com/advisories/GHSA-f6hv-jmp6-3vwv
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47244.json
- https://github.com/netty/netty/security/advisories/GHSA-5x3r-wrvg-rp6q
- https://nvd.nist.gov/vuln/detail/CVE-2026-47244
- https://github.com/advisories/GHSA-5x3r-wrvg-rp6q
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48043.json
- https://access.redhat.com/errata/RHSA-2026:26017
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:48124
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/security/cve/CVE-2026-48043
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48043.json
- https://github.com/netty/netty/security/advisories/GHSA-c2gf-v879-257j
- https://nvd.nist.gov/vuln/detail/CVE-2026-48043
- https://github.com/advisories/GHSA-c2gf-v879-257j
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50560.json
- https://github.com/netty/netty/security/advisories/GHSA-563q-j3cm-6jxm
- https://nvd.nist.gov/vuln/detail/CVE-2026-50560
- https://github.com/advisories/GHSA-563q-j3cm-6jxm
- https://github.com/netty/netty/releases/tag/netty-4.1.136.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.16.Final
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56819.json
- https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972
- https://nvd.nist.gov/vuln/detail/CVE-2026-56819
- https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b
- https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6
- https://github.com/advisories/GHSA-93wv-jw9v-4972
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59900.json
- https://github.com/netty/netty/security/advisories/GHSA-c69g-56f8-xwqj
- https://nvd.nist.gov/vuln/detail/CVE-2026-59900
- https://github.com/advisories/GHSA-c69g-56f8-xwqj
- Credits
-
-
- Red Hat Lightwell - REMEDIATION_DEVELOPER
-
Affected packages
Red Hat Lightwell:Maven / io.netty:netty-codec-http2
Package
- Name
- io.netty:netty-codec-http2
- Purl
- pkg:maven/io.netty/netty-codec-http2
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed4.1.100.Final-rhlw-00001
Affected versions
4.*
4.1.0.Beta4
4.1.0.Beta5
4.1.0.Beta6
4.1.0.Beta7
4.1.0.Beta8
4.1.0.CR1
4.1.0.CR2
4.1.0.CR3
4.1.0.CR4
4.1.0.CR5
4.1.0.CR6
4.1.0.CR7
4.1.0.Final
4.1.1.Final
4.1.2.Final
4.1.3.Final
4.1.4.Final
4.1.5.Final
4.1.6.Final
4.1.7.Final
4.1.8.Final
4.1.9.Final
4.1.10.Final
4.1.11.Final
4.1.12.Final
4.1.13.Final
4.1.14.Final
4.1.15.Final
4.1.16.Final
4.1.17.Final
4.1.18.Final
4.1.19.Final
4.1.20.Final
4.1.21.Final
4.1.22.Final
4.1.23.Final
4.1.24.Final
4.1.25.Final
4.1.26.Final
4.1.27.Final
4.1.28.Final
4.1.29.Final
4.1.30.Final
4.1.31.Final
4.1.32.Final
4.1.33.Final
4.1.34.Final
4.1.35.Final
4.1.36.Final
4.1.37.Final
4.1.38.Final
4.1.39.Final
4.1.40.Final
4.1.41.Final
4.1.42.Final
4.1.43.Final
4.1.44.Final
4.1.45.Final
4.1.46.Final
4.1.47.Final
4.1.48.Final
4.1.49.Final
4.1.50.Final
4.1.51.Final
4.1.52.Final
4.1.53.Final
4.1.54.Final
4.1.55.Final
4.1.56.Final
4.1.57.Final
4.1.58.Final
4.1.59.Final
4.1.60.Final
4.1.61.Final
4.1.62.Final
4.1.63.Final
4.1.64.Final
4.1.65.Final
4.1.66.Final
4.1.67.Final
4.1.68.Final
4.1.69.Final
4.1.70.Final
4.1.71.Final
4.1.72.Final
4.1.73.Final
4.1.74.Final
4.1.75.Final
4.1.76.Final
4.1.77.Final
4.1.78.Final
4.1.79.Final
4.1.80.Final
4.1.81.Final
4.1.82.Final
4.1.83.Final
4.1.84.Final
4.1.85.Final
4.1.86.Final
4.1.87.Final
4.1.88.Final
4.1.89.Final
4.1.90.Final
4.1.91.Final
4.1.92.Final
4.1.93.Final
4.1.94.Final
4.1.95.Final
4.1.96.Final
4.1.97.Final
4.1.98.Final
4.1.99.Final
4.1.100.Final
Database specific
lightwell
{
"backport_base_version": "4.1.100.Final",
"remediated_version": "4.1.100.Final-rhlw-00001",
"repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-1caafb676cc0f4c9.json"