[UPDATE] [high] Netty: Multiple vulnerabilities
A remote, anonymous attacker can exploit multiple vulnerabilities in Netty to bypass security measures, manipulate data, disclose confidential information, or cause a denial-of-service condition.
CSIRTS triage
- What
- Multiple vulnerabilities allow a remote, anonymous attacker to bypass security measures, manipulate data, disclose confidential information, or cause a denial-of-service condition.
- Who is affected
- Deployments of Netty.
- Urgency
- Remediation is high urgency due to the severity and potential for exploitation.
- Action
- Update to the latest version of Netty.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Netty
Get an email when a new Netty advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1814
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-500090.20% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 10% of all scored CVEs.
- Low exploitation riskCVE-2026-442490.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all scored CVEs.
- Low exploitation riskCVE-2026-442500.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.
- Low exploitation riskCVE-2026-448900.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all scored CVEs.
- Low exploitation riskCVE-2026-448920.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all scored CVEs.
- Low exploitation riskCVE-2026-448930.59% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 44% of all scored CVEs.
- Low exploitation riskCVE-2026-448940.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 4% of all scored CVEs.
- Low exploitation riskCVE-2026-454160.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 37% of all scored CVEs.
- Low exploitation riskCVE-2026-455360.14% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 3% of all scored CVEs.
- Low exploitation riskCVE-2026-456730.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- highGHSA-h2qv-fj59-j46j: Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Mem…ghsa
- mediumGHSA-c2gf-v879-257j: netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Le…ghsa
- highGHSA-6jv9-x5w9-2ccm: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorghsa
- highGHSA-5pvg-856g-cp85: Netty has Insufficient Bailiwick Validation for NS Recordsghsa
- highGHSA-676x-f7gg-47vc: Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Recordsghsa
Recent advisories for Netty
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- medium[UPDATE] [medium] Netty: Multiple vulnerabilitiescert-bund · 2026-07-10
- mediumCVE-2026-49365: Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Net…nvd · 2026-07-06
- medium[UPDATE] [medium] Netty: Multiple vulnerabilitiescert-bund · 2026-07-02
- highGHSA-h2qv-fj59-j46j: Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Mem…ghsa · 2026-06-11
- mediumGHSA-c2gf-v879-257j: netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Le…ghsa · 2026-06-11
- highGHSA-6jv9-x5w9-2ccm: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorghsa · 2026-06-11
More from CERT-Bund (BSI) Security Advisories
- medium[NEW] [medium] DENX U-Boot: Multiple vulnerabilities allow execution of arbitrary code and DoS2026-07-10
- medium[NEW] [medium] Samsung Android: Multiple vulnerabilities2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow unspecified attack2026-07-10
- medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilities allow denial of service2026-07-10