RHLW-2026-313117b0cad7329e
- Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-313117b0cad7329e.json
- Import Source
- https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-313117b0cad7329e.json
- JSON Data
- https://api.osv.dev/v1/vulns/RHLW-2026-313117b0cad7329e
- Upstream
- Published
- 2026-10-12T16:58:10Z
- Modified
- 2026-10-27T04:13:04Z
- Severity
-
- 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Lightwell Security Advisory: netty-handler 4.1.100.Final-rhlw-00001
- Details
-
Red Hat Lightwell has released io.netty:netty-handler 4.1.100.Final-rhlw-00001 with backported fixes for CVE-2025-24970, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010, CVE-2026-75595, and CVE-2026-75596.
CVE-2025-24970: SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
CVE-2026-44249: Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
CVE-2026-45416: Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
CVE-2026-50010: Netty's wrapping plain trust manager silently disables hostname verification
CVE-2026-75595: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-75596: Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
This patched artifact is a drop-in replacement for io.netty:netty-handler 4.1.100.Final from Maven Central.
- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24970.json
- https://github.com/netty/netty/security/advisories/GHSA-4g8c-wm8x-jfhw
- https://nvd.nist.gov/vuln/detail/CVE-2025-24970
- https://github.com/netty/netty/commit/87f40725155b2f89adfde68c7732f97c153676c4
- https://github.com/advisories/GHSA-4g8c-wm8x-jfhw
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json
- https://access.redhat.com/errata/RHSA-2026:26017
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:28573
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:48124
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:49700
- https://access.redhat.com/errata/RHSA-2026:49701
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/security/cve/CVE-2026-44249
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44249.json
- https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86
- https://nvd.nist.gov/vuln/detail/CVE-2026-44249
- https://github.com/advisories/GHSA-3qp7-7mw8-wx86
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45416.json
- https://access.redhat.com/errata/RHSA-2026:62260
- https://access.redhat.com/security/cve/CVE-2026-45416
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45416.json
- https://github.com/netty/netty/security/advisories/GHSA-x4gw-5cx5-pgmh
- https://nvd.nist.gov/vuln/detail/CVE-2026-45416
- https://github.com/advisories/GHSA-x4gw-5cx5-pgmh
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-50010.json
- https://access.redhat.com/security/cve/CVE-2026-50010
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50010.json
- https://github.com/netty/netty/security/advisories/GHSA-c653-97m9-rcg9
- https://nvd.nist.gov/vuln/detail/CVE-2026-50010
- https://github.com/advisories/GHSA-c653-97m9-rcg9
- https://github.com/netty/netty/releases/tag/netty-4.1.137.Final
- https://github.com/netty/netty/releases/tag/netty-4.2.17.Final
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75595.json
- https://github.com/netty/netty/security/advisories/GHSA-c4c3-7fpv-j4q5
- https://nvd.nist.gov/vuln/detail/CVE-2026-75595
- https://github.com/netty/netty/commit/1b5abc6443b63726c72cdd285af2feb7ddbb8ff7
- https://github.com/netty/netty/commit/9e0519239108a69b7e9bbc5e9182ee139a0d7961
- https://github.com/netty/netty/pull/17213
- https://github.com/netty/netty/pull/17217
- https://github.com/advisories/GHSA-c4c3-7fpv-j4q5
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75596.json
- https://github.com/netty/netty/security/advisories/GHSA-fccg-mwvh-qqg4
- https://nvd.nist.gov/vuln/detail/CVE-2026-75596
- https://github.com/advisories/GHSA-fccg-mwvh-qqg4
- Credits
-
-
- Red Hat Lightwell - REMEDIATION_DEVELOPER
-
Affected packages
Red Hat Lightwell:Maven / io.netty:netty-handler
Package
- Name
- io.netty:netty-handler
- Purl
- pkg:maven/io.netty/netty-handler
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed4.1.100.Final-rhlw-00001
Affected versions
4.*
4.0.0.Alpha1
4.0.0.Alpha2
4.0.0.Alpha3
4.0.0.Alpha4
4.0.0.Alpha5
4.0.0.Alpha6
4.0.0.Alpha7
4.0.0.Alpha8
4.0.0.Beta1
4.0.0.Beta2
4.0.0.Beta3
4.0.0.CR1
4.0.0.CR2
4.0.0.CR3
4.0.0.CR4
4.0.0.CR5
4.0.0.CR6
4.0.0.CR7
4.0.0.CR8
4.0.0.CR9
4.0.0.Final
4.0.1.Final
4.0.2.Final
4.0.3.Final
4.0.4.Final
4.0.5.Final
4.0.6.Final
4.0.7.Final
4.0.8.Final
4.0.9.Final
4.0.10.Final
4.0.11.Final
4.0.12.Final
4.0.13.Final
4.0.14.Beta1
4.0.14.Final
4.0.15.Final
4.0.16.Final
4.0.17.Final
4.0.18.Final
4.0.19.Final
4.0.20.Final
4.0.21.Final
4.0.22.Final
4.0.23.Final
4.0.24.Final
4.0.25.Final
4.0.26.Final
4.0.27.Final
4.0.28.Final
4.0.29.Final
4.0.30.Final
4.0.31.Final
4.0.32.Final
4.0.33.Final
4.0.34.Final
4.0.35.Final
4.0.36.Final
4.0.37.Final
4.0.38.Final
4.0.39.Final
4.0.40.Final
4.0.41.Final
4.0.42.Final
4.0.43.Final
4.0.44.Final
4.0.45.Final
4.0.46.Final
4.0.47.Final
4.0.48.Final
4.0.49.Final
4.0.50.Final
4.0.51.Final
4.0.52.Final
4.0.53.Final
4.0.54.Final
4.0.55.Final
4.0.56.Final
4.1.0.Beta1
4.1.0.Beta2
4.1.0.Beta3
4.1.0.Beta4
4.1.0.Beta5
4.1.0.Beta6
4.1.0.Beta7
4.1.0.Beta8
4.1.0.CR1
4.1.0.CR2
4.1.0.CR3
4.1.0.CR4
4.1.0.CR5
4.1.0.CR6
4.1.0.CR7
4.1.0.Final
4.1.1.Final
4.1.2.Final
4.1.3.Final
4.1.4.Final
4.1.5.Final
4.1.6.Final
4.1.7.Final
4.1.8.Final
4.1.9.Final
4.1.10.Final
4.1.11.Final
4.1.12.Final
4.1.13.Final
4.1.14.Final
4.1.15.Final
4.1.16.Final
4.1.17.Final
4.1.18.Final
4.1.19.Final
4.1.20.Final
4.1.21.Final
4.1.22.Final
4.1.23.Final
4.1.24.Final
4.1.25.Final
4.1.26.Final
4.1.27.Final
4.1.28.Final
4.1.29.Final
4.1.30.Final
4.1.31.Final
4.1.32.Final
4.1.33.Final
4.1.34.Final
4.1.35.Final
4.1.36.Final
4.1.37.Final
4.1.38.Final
4.1.39.Final
4.1.40.Final
4.1.41.Final
4.1.42.Final
4.1.43.Final
4.1.44.Final
4.1.45.Final
4.1.46.Final
4.1.47.Final
4.1.48.Final
4.1.49.Final
4.1.50.Final
4.1.51.Final
4.1.52.Final
4.1.53.Final
4.1.54.Final
4.1.55.Final
4.1.56.Final
4.1.57.Final
4.1.58.Final
4.1.59.Final
4.1.60.Final
4.1.61.Final
4.1.62.Final
4.1.63.Final
4.1.64.Final
4.1.65.Final
4.1.66.Final
4.1.67.Final
4.1.68.Final
4.1.69.Final
4.1.70.Final
4.1.71.Final
4.1.72.Final
4.1.73.Final
4.1.74.Final
4.1.75.Final
4.1.76.Final
4.1.77.Final
4.1.78.Final
4.1.79.Final
4.1.80.Final
4.1.81.Final
4.1.82.Final
4.1.83.Final
4.1.84.Final
4.1.85.Final
4.1.86.Final
4.1.87.Final
4.1.88.Final
4.1.89.Final
4.1.90.Final
4.1.91.Final
4.1.92.Final
4.1.93.Final
4.1.94.Final
4.1.95.Final
4.1.96.Final
4.1.97.Final
4.1.98.Final
4.1.99.Final
4.1.100.Final
Database specific
lightwell
{
"backport_base_version": "4.1.100.Final",
"remediated_version": "4.1.100.Final-rhlw-00001",
"repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-313117b0cad7329e.json"