Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.

ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments

Severity

Clear filters

7 matching advisories · 7 shown

Explore packages Subscribe to these results

Follow substantive record changes →

SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED

medium6.5

CVE-2026-93562

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Public exploit reference

Red Hat · Red Hat Build of Debezium 3.6 / Red Hat · Red Hat build of Keycloak 26.4

18 Sept 2026

medium6.5

CVE-2026-93579

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat Build of Debezium 3.6 / Red Hat · Red Hat build of Keycloak 26.4

18 Sept 2026

medium6.5

CVE-2026-93566

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat Build of Debezium 3.6 / Red Hat · Red Hat build of Keycloak 26.4

18 Sept 2026

high7.5

CVE-2026-93565

Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf() function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat Build of Apache Camel 3.33.3.SP2 / Red Hat · Red Hat Build of Debezium 3.6

18 Sept 2026

high7.5

CVE-2026-93564

Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat Build of Apache Camel 3.33.3.SP2 / Red Hat · Red Hat Build of Debezium 3.6

18 Sept 2026

high7.5

CVE-2026-93558

Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Public exploit reference

Red Hat · Red Hat Build of Apache Camel 3.33.3.SP2 / Red Hat · Red Hat Build of Debezium 3.6

18 Sept 2026

medium5.3

CVE-2026-93492

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS).

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat Build of Debezium 3.6 / Red Hat · Red Hat build of Keycloak 26.4

18 Sept 2026