CVE-2026-48059
Estado: ModificadaAlta (8.7)—
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 8.7
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.88%
- Percentil entre todas las CVEs puntuadas: 58
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access75 % - Impacto principal
T1499.004Application or System Exploitationimpact80 %
Red sin privilegios (AV:N, PR:N, UI:N). Memory leak en cada conexión válida agota recursos (VA:H); es DoS de degradación de disponibilidad por agotamiento de recursos.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-401
- CWE-1286
Referencias
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j
- https://access.redhat.com/errata/RHSA-2026:26017
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/security/cve/CVE-2026-48059
- https://bugzilla.redhat.com/show_bug.cgi?id=2488437
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48059.json
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-48059",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-48059",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-06-12T16:14:17.314653Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 8.7,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "netty",
"product": "netty",
"versions": [
{
"status": "affected",
"version": ">= 4.2.0.Final, < 4.2.15.Final"
},
{
"status": "affected",
"version": "< 4.1.135.Final"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"vendor": "Red Hat",
"product": "Cryostat 4 on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "4.2.0-13",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "cryostat/cryostat-reports-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"vendor": "Red Hat",
"product": "Cryostat 4 on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "4.2.0-13",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "cryostat/cryostat-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"vendor": "Red Hat",
"product": "Cryostat 4 on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "4.2.0-13",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "cryostat/jfr-datasource-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:amq_broker:7.14"
],
"vendor": "Red Hat",
"product": "Red Hat AMQ Broker 7.14.1",
"versions": [
{
"status": "unaffected",
"version": "codec-haproxy",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:apache_camel_quarkus:3.33"
],
"vendor": "Red Hat",
"product": "Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1",
"versions": [
{
"status": "unaffected",
"version": "codec-haproxy",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"vendor": "Red Hat",
"product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
"versions": [
{
"status": "unaffected",
"version": "codec-haproxy",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:quarkus:3.27::el8"
],
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 3.27.4.SP1",
"versions": [
{
"status": "unaffected",
"version": "codec-haproxy",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:quarkus:3.33::el8"
],
"vendor": "Red Hat",
"product": "Red Hat build of Quarkus 3.33.2.SP1",
"versions": [
{
"status": "unaffected",
"version": "codec-haproxy",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"vendor": "Red Hat",
"product": "Red Hat Data Grid 8.6.2",
"versions": [
{
"status": "unaffected",
"version": "codec-haproxy",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-activemq-artemis",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-glassfish-jsf",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-ironjacamar",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-annotations",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-core",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-databind",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-jaxrs-providers",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-modules-base",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-modules-java8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-remoting",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-server-migration",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-netty-transport-native-epoll",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-picketlink-bindings",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-picketlink-federation",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-undertow",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"versions": [
{
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-activemq-artemis",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-glassfish-jsf",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-ironjacamar",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-annotations",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-core",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-databind",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-jaxrs-providers",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-modules-base",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-modules-java8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-remoting",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-server-migration",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-netty-transport-native-epoll",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-picketlink-bindings",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-picketlink-federation",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.40-1.SP3_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-undertow",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8",
"versions": [
{
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el8eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-activemq-artemis",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-glassfish-jsf",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-ironjacamar",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-annotations",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-core",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-databind",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-jaxrs-providers",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-modules-base",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jackson-modules-java8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-remoting",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-jboss-server-migration",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-netty-transport-native-epoll",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-picketlink-bindings",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-picketlink-federation",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.40-1.SP3_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-undertow",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9",
"versions": [
{
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el9eap",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "eap7-wildfly",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_xp:6.0"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"versions": [
{
"status": "unaffected",
"version": "codec-haproxy",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:amq_streams:2.9::el9"
],
"vendor": "Red Hat",
"product": "Streams for Apache Kafka 2.9.4",
"versions": [
{
"status": "unaffected",
"version": "codec-haproxy",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:amq_streams:3.2::el9"
],
"vendor": "Red Hat",
"product": "Streams for Apache Kafka 3.2.1",
"versions": [
{
"status": "unaffected",
"version": "codec-haproxy",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "netty",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI 2.25",
"versions": [
{
"status": "unaffected",
"version": "1788198681",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "rhoai/odh-trustyai-service-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"versions": [
{
"status": "unaffected",
"version": "1782989027",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "devspaces/multicluster-redirector-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"vendor": "Red Hat",
"product": "OpenShift Serverless",
"packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"vendor": "Red Hat",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"packageName": "netty-codec-haproxy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4"
],
"vendor": "Red Hat",
"product": "Red Hat build of Apache Camel - HawtIO 4",
"packageName": "netty-codec-haproxy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"vendor": "Red Hat",
"product": "Red Hat build of Apicurio Registry 3",
"packageName": "netty-codec-haproxy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"vendor": "Red Hat",
"product": "Red Hat build of Debezium 3",
"packageName": "netty-codec-haproxy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"packageName": "netty-codec-haproxy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"packageName": "rhbk/keycloak-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"packageName": "rhbk/keycloak-rhel9-operator",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"vendor": "Red Hat",
"product": "Red Hat Build of Keycloak",
"packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"vendor": "Red Hat",
"product": "Red Hat Fuse 7",
"packageName": "netty-codec-haproxy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"vendor": "Red Hat",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"packageName": "netty-codec-haproxy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
"packageName": "rhoai/odh-openvino-model-server-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"vendor": "Red Hat",
"product": "Red Hat Satellite 6",
"packageName": "candlepin",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"vendor": "Red Hat",
"product": "Red Hat Single Sign-On 7",
"packageName": "netty-codec-haproxy",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-06-12T16:16:30.720",
"references": [
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"tags": [
"Release Notes"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/netty/netty/security/advisories/GHSA-h2qv-fj59-j46j",
"tags": [
"Vendor Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26017",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26018",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:26586",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:34608",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:36820",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:37390",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:41951",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:48151",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:50085",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:53644",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:53645",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:53646",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:54435",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:65126",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:66488",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-48059",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488437",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48059.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
},
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"description": [
{
"lang": "en",
"value": "CWE-1286"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the successful parse path — no exception is thrown, the message fires downstream, the decoder removes itself, and the application releases the `HAProxyMessage` normally. Yet the underlying cumulation buffer (a pooled, potentially direct `ByteBuf` allocated by the channel) remains permanently pinned. Versions 4.1.135.Final and 4.2.15.Final patch the issue."
}
],
"lastModified": "2026-09-18T13:18:30.730",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3097D962-A32D-4467-AAE7-F4CBA3A349D2",
"versionEndExcluding": "4.1.135"
},
{
"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "413D4611-A46C-4BE4-AB2F-D86282F65984",
"versionEndExcluding": "4.2.15",
"versionStartIncluding": "4.2.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}