Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Netty io.netty libraries may allow remote code execution
published 2 months ago
Summary
Two security weaknesses were found in several Netty io.netty components, such as the HTTP/2 and HTTP codec libraries. Attackers could potentially run unauthorized code on affected systems. Update the packages to version 4.1.48.Final-tuxcare.3 to close the gaps.
What to do
- Update netty io.netty:netty-codec-http2 to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-haproxy to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-http to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-bom to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-all to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-dns to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-buffer to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-transport-native-kqueue to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-dev-tools to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-transport-udt to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-testsuite-autobahn to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-handler-proxy to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-transport-native-epoll to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-common to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-smtp to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-memcache to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-xml to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-transport-sctp to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-stomp to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-handler to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-parent to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-testsuite-osgi to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-transport-blockhound-tests to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-redis to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-example to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-transport-rxtx to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-testsuite to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-resolver-dns to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-resolver to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-microbench to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-transport-native-unix-common to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-transport to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-testsuite-http2 to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-socks to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-codec-mqtt to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-transport-native-unix-common-tests to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-resolver-dns-native-macos to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-tarball to version 4.1.48.Final-tuxcare.3.
- Update netty io.netty:netty-testsuite-native-image to version 4.1.48.Final-tuxcare.3.
- Update io.netty:netty-codec-http2 to version 4.1.48.Final-tuxcare.3.
- Update io.netty:netty-codec-redis to version 4.1.48.Final-tuxcare.3.
- Update io.netty:netty-example to version 4.1.48.Final-tuxcare.3.
- Update io.netty:netty-microbench to version 4.1.48.Final-tuxcare.3.
- Update io.netty:netty-testsuite-http2 to version 4.1.48.Final-tuxcare.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | netty | io.netty:netty-codec-http2 |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-haproxy |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-http |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-bom |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-all |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-dns |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-buffer |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-transport-native-kqueue |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-dev-tools |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-transport-udt |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-testsuite-autobahn |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-handler-proxy |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-transport-native-epoll |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-common |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-smtp |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-memcache |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-xml |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-transport-sctp |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-stomp |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-handler |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-parent |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-testsuite-osgi |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-transport-blockhound-tests |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-redis |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-example |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-transport-rxtx |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-testsuite |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-resolver-dns |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-resolver |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-microbench |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-transport-native-unix-common |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-transport |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-testsuite-http2 |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-socks |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-codec-mqtt |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-transport-native-unix-common-tests |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-resolver-dns-native-macos |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-tarball |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | netty | io.netty:netty-testsuite-native-image |
< 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | – | io.netty:netty-codec-http2 |
>= 4.1.48.Final, < 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | – | io.netty:netty-codec-redis |
>= 4.1.48.Final, < 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | – | io.netty:netty-example |
>= 4.1.48.Final, < 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | – | io.netty:netty-microbench |
>= 4.1.48.Final, < 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
| TuxCare:Maven | – | io.netty:netty-testsuite-http2 |
>= 4.1.48.Final, < 4.1.48.Final-tuxcare.3 Fix: upgrade to 4.1.48.Final-tuxcare.3
|
Original advisory text
TuxCare security update for io.netty (2 CVEs)
TuxCare rebuilt 2 io.netty packages to address 2 CVEs. Fixed in 4.1.48.Final-tuxcare.3.
Timeline
Published31 Aug 2026
Updated2 Nov 2026
First seen31 Aug 2026
Sources
CLSA-2026-1788193903 · OSV
Track software like this
Free during beta