Search
Search Results (6 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93494 | 1 Redhat | 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more | 2026-09-18 | 7.5 High |
| A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec. | ||||
| CVE-2026-93563 | 1 Redhat | 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more | 2026-09-18 | N/A |
| Unbounded multi-line response accumulation in SmtpResponseDecoder leads to memory-exhaustion DoS | ||||
| CVE-2026-93578 | 1 Redhat | 1 Camel Spring Boot | 2026-09-18 | N/A |
| Missing Extended Key Usage (EKU) check in OCSP Client allows certificate revocation bypass | ||||
| CVE-2026-93575 | 1 Redhat | 5 Amq Broker, Camel Spring Boot, Jboss Enterprise Application Platform and 2 more | 2026-09-18 | N/A |
| ### Summary Netty's fix for CVE-2026-44248 is incomplete. The decoder checks if the MQTT packet's `Remaining Length` exceeds `maxBytesInMessage`, but fails to validate the `Properties Length` against the `Remaining Length`. An attacker can bypass the size limit by sending a small `Remaining Length` but an enormous `Properties Length`. This forces Netty to buffer and parse millions of properties, allowing an unauthenticated remote attacker to trigger excessive memory and CPU consumption, leading to OutOfMemoryError. ### Details In `io.netty.handler.codec.mqtt.MqttDecoder`, the `decodeProperties()` helper method reads `totalPropertiesLength` and attempts to parse that many bytes. If the buffer lacks the full length, a `Signal` is thrown. The `catch` block inside `decode()` only enforces `maxBytesInMessage` against `bytesRemainingBeforeVariableHeader` (the packet's `Remaining Length`). By sending a `CONNECT` packet with a small `Remaining Length` but a huge `Properties Length`, the size check passes. `ReplayingDecoder` then buffers data from the network until the huge `Properties Length` is reached, parsing millions of `UserProperty` objects and exhausting CPU and memory. # | ||||
| CVE-2026-93561 | 1 Redhat | 4 Camel Spring Boot, Jboss Enterprise Application Platform, Jboss Fuse and 1 more | 2026-09-18 | N/A |
| Memcache binary codec signed/unsigned type mismatch causes frame desynchronization and response smuggling | ||||
| CVE-2026-87283 | 1 Oracle | 1 Vm Virtualbox | 2026-09-17 | 6 Medium |
| Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H). | ||||
Page 1 of 1.