Netty Lz4FrameDecoder is vulnerable to resource exhaustion

CVE-2026-42583

### Summary Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB per block) before LZ4 runs. A

历史摘要 · 未重新核验 · GitHub Advisory

Netty HTTP/3 QPACK literal unbounded allocation

CVE-2026-42582

### Summary When Netty decodes HTTP/3 headers, it sometimes runs `new byte[length]` using a length from the wire before

历史摘要 · 未重新核验 · GitHub Advisory

Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

CVE-2026-42581

# NETTY HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization | Field | Value | |-----------|-------| | Librar

历史摘要 · 未重新核验 · GitHub Advisory

Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing

CVE-2026-42580

### Summary Netty's chunk size parser silently overflows int, enabling request smuggling attacks. ### Details io.netty.

历史摘要 · 未重新核验 · GitHub Advisory

Netty has a DNS Codec Input Validation Bypass (Encoder + Decoder)

CVE-2026-42579

# Security Vulnerability Report: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) ## 1. Vulnerability Sum

历史摘要 · 未重新核验 · GitHub Advisory

Netty has HTTP Header Injection via HttpProxyHandler Disabled Validation (Incomplete Fix CVE-2025-67735)

CVE-2026-42578

# Security Vulnerability Report: HTTP Header Injection via HttpProxyHandler Disabled Validation in Netty ## 1. Vulnerab

历史摘要 · 未重新核验 · GitHub Advisory

OpenSearch has ineffective TLS certificate hostname verification

### Description A regression was introduced in OpenSearch 2.18.0 that caused the `plugins.security.ssl.transport.enforc

历史摘要 · 未重新核验 · GitHub Advisory

OpenSearch Security plugin: DLS not applied on documents linked by has_child or has_parent relation

### Description A flaw was identified in the OpenSearch Security plugin's document-level security (DLS) implementation.

历史摘要 · 未重新核验 · GitHub Advisory

OpenSearch vulnerable to improper authorization for Rollover Requests

### Description A flaw was identified in the OpenSearch Security plugin's handling of index rollover requests. When a r

历史摘要 · 未重新核验 · GitHub Advisory

OpenSearch has a bypass of REST Layer Authorization Using Malformed Paths

### Description A flaw was identified in the OpenSearch REST layer that could allow authorization checks to be bypassed

历史摘要 · 未重新核验 · GitHub Advisory

Spring Cloud AWS missing SNS message signature verification allows spoofing of HTTP/HTTPS endpoint notifications

CVE-2026-44308

### Impact Applications using Spring Cloud AWS SNS HTTP/HTTPS endpoint support (@NotificationMessageMapping, @Notif

历史摘要 · 未重新核验 · GitHub Advisory

axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

## Summary The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key ret

历史摘要 · 未重新核验 · GitHub Advisory

ArcadeDB vulnerable to cross-database authorization bypass and unsecured newly-created databases

CVE-2026-44221

### Impact Authenticated users and API tokens scoped to a specific database could read, write, and mutate schema on any

历史摘要 · 未重新核验 · GitHub Advisory

jdbi3-freemarker Vulnerable to Improper Neutralization of Special Elements Used in FreeMarker Template Engine

# Summary **Description** An Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) vulnerab

历史摘要 · 未重新核验 · GitHub Advisory

pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS

CVE-2026-42198

## Summary pgjdbc is vulnerable to a client-side denial of service during SCRAM-SHA-256 authentication. ### Impact A ma

历史摘要 · 未重新核验 · GitHub Advisory

Geyser Vulnerable to Server-Side Request Forgery (SSRF) via Player Head Texture URL in Geyser

CVE-2026-42188

### Summary A server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player head textur

历史摘要 · 未重新核验 · GitHub Advisory

XWiki PlantUML Macro Vulnerable to Server-Side Request Forgery (SSRF) via 'server' parameter

CVE-2026-42140

### Impact The [PlantUML Macro](https://extensions.xwiki.org/xwiki/bin/view/Extension/PlantUML+Macro) is vulnerable to

历史摘要 · 未重新核验 · GitHub Advisory

quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

CVE-2026-42333

### Summary The generated authentication filter matches OpenAPI path templates too broadly when deciding whether to att

历史摘要 · 未重新核验 · GitHub Advisory

Sandboxed Thymeleaf expressions vulnerable to improper recognition of unauthorized syntax patterns

CVE-2026-41901

### Impact A security bypass vulnerability exists in the expression execution mechanisms of Thymeleaf up to and includi

历史摘要 · 未重新核验 · GitHub Advisory