Netty: Mehrere Schwachstellen
WID-SEC-2026-2356 · first 15.07.2026 · updated 26.10.2026 · CVSS 8,1
What it is about
Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients. Ein Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsprüfungen zu umgehen, Anfragen oder Header zu manipulieren, Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- Sicherheitsprüfungen zu umgehen
- Anfragen oder Header zu manipulieren
- Zertifikatsprüfungen zu unterlaufen sowie einen Denial of Service zu verursachen
Am I affected?
Affected according to the BSI:
- IBM DB2
- Red Hat Enterprise Linux
- IBM License Metric Tool
- SUSE Linux
- Open Source Netty <4.2.16
- Open Source Netty <4.1.136
- IBM App Connect Enterprise for Manufactoring
- IBM SPSS Modeler 19.0.0.0
- IBM SPSS Analytic Server
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Netty 4.2.16
- Open Source Netty 4.1.136
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- GitHub Security Advisory GHSA-4qhr-g3c6-fcfx vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-272m-gcwp-mpwg vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-3g8r-4pfx-jmfh vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-4mp9-239f-g9hg vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-q4f6-jm68-57ww vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-c69g-56f8-xwqj vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-558v-64gr-wgg4 vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-6jqx-86gh-f27w vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-93wv-jw9v-4972 vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-g7hg-vrcf-mvmr vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-gcjf-9mgh-3p7g vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-hpcc-26xq-25fv vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-jppx-w49h-x2qq vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-mvh2-crg5-v77c vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-q6cq-mhr2-jmr5 vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-vhch-2wf3-m8rp vom 2026-07-14 github.com
- GitHub Security Advisory GHSA-wc96-39fc-566f vom 2026-07-14 github.com
- Red Hat Security Advisory RHSA-2026:48118 vom 2026-07-29 access.redhat.com
- Red Hat Security Advisory RHSA-2026:47189 vom 2026-07-29 access.redhat.com
- Red Hat Security Advisory RHSA-2026:47172 vom 2026-07-30 access.redhat.com
- SUSE Security Update SUSE-SU-2026:3482-1 vom 2026-08-04 lists.suse.com
- IBM Security Bulletin 7282895 vom 2026-08-07 www.ibm.com
- Red Hat Security Advisory RHSA-2026:54435 vom 2026-08-12 access.redhat.com
- Red Hat Security Advisory RHSA-2026:54622 vom 2026-08-13 access.redhat.com
- IBM Security Bulletin 7285407 vom 2026-08-27 www.ibm.com
and 13 more sources in the original advisory
CVE: CVE-2026-44891, CVE-2026-55831, CVE-2026-55833, CVE-2026-55851, CVE-2026-56745, CVE-2026-56816, CVE-2026-56817, CVE-2026-56819, CVE-2026-56820, CVE-2026-56821, CVE-2026-56822, CVE-2026-59898, CVE-2026-59899, CVE-2026-59900, CVE-2026-59901, CVE-2026-59920, CVE-2026-59921
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.