Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
SonarQube could be tricked to run unauthorized code
published 1 month ago
Summary
The SonarQube product uses the Netty network library, which contains a flaw that lets a remote attacker send specially crafted data and cause the server to execute code it should not run. This could let an attacker take control of the SonarQube server or access its data. Install the latest SonarQube release that includes the Netty fix, or apply the vendor’s recommended patch as soon as possible.
What to do
- Update cleanstart sonarqube to version 26.6.0.123539-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | sonarqube |
< 26.6.0.123539-r0 Fix: upgrade to 26.6.0.123539-r0
|
Original advisory text
Netty is a network application framework for development of protocol servers and clients
Security vulnerability affects the sonarqube package. Netty is a network application framework for development of protocol servers and clients.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published6 Oct 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
CLEANSTART-2026-KM44899 · OSV
Track software like this
Free during beta