IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.5High

CVE-2026-33870Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

netty netty; Red Hat Cryostat 4 on RHEL 9; Red Hat Red Hat AMQ Broker 7.12.7; Red Hat Red Hat AMQ Broker 7.13.5 Published: (7 months ago)

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Weakness (CWE): CWE-444

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
amq streams 2.9 —
amq streams 3.2 —
cryostat 4 —
jboss enterprise application platform 8.1 —
netty netty < 4.1.132.Final, >= 4.2.0.Alpha1, < 4.2.10.Final
openshift ai 2.25 —
openshift devspaces 3.27 —
quarkus 3.20 —
quarkus 3.27 —
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat Logging Subsystem for Red Hat OpenShift all versions
Red Hat OpenShift Serverless all versions
Red Hat Red Hat AMQ Broker 7.12.7 all versions
Red Hat Red Hat AMQ Broker 7.13.5 all versions
Red Hat Red Hat AMQ Broker 7.14.0 all versions
Red Hat Red Hat AMQ Clients all versions
Red Hat Red Hat build of Apache Camel 4 for Quarkus 3 all versions
Red Hat Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 all versions
Red Hat Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 all versions
Red Hat Red Hat build of Apache Camel - HawtIO 4 all versions
Red Hat Red Hat build of Apicurio Registry 2 all versions
Red Hat Red Hat build of Apicurio Registry 3 all versions
Red Hat Red Hat build of Debezium 3 all versions
Red Hat Red Hat Build of Keycloak all versions
Red Hat Red Hat build of OptaPlanner 8 all versions
Red Hat Red Hat build of Quarkus 3.20.6 all versions
Red Hat Red Hat build of Quarkus 3.27.3 all versions
Red Hat Red Hat Data Grid 8.6.1 all versions
Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3 all versions
Red Hat Red Hat Fuse 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 7 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 all versions
Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 all versions
Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack —
Red Hat Red Hat OpenShift AI 2.25 all versions
Red Hat Red Hat OpenShift AI (RHOAI) all versions
Red Hat Red Hat OpenShift Dev Spaces 3.27 all versions
Red Hat Red Hat Process Automation 7 all versions
Red Hat Red Hat Satellite 6 —
Red Hat Red Hat Single Sign-On 7 all versions
Red Hat Streams for Apache Kafka 2.9.4 all versions
Red Hat streams for Apache Kafka 3 —
Red Hat Streams for Apache Kafka 3.2.0 —

References and patches

CPE matches (NVD) (2)
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* < 4.1.132
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* ≥ 4.2.0 < 4.2.10

Recent CVEs in the same product — Red Hat Enterprise Linux

5.5Medium
CVE-2026-127101

Sssd: sssd: null pointer dereference in pam responder when protocol version negotiation is skipped

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication.…

5.5Medium
CVE-2026-127100

Sssd: sssd: local denial of service through unchecked oauth2 json code type in pam responder

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, t…

5.9Medium
CVE-2026-127099

Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized …

5.5Medium
CVE-2026-126831

Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copie…

7.9High
CVE-2026-121876

Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers)

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by ty…