Hi,

The following vulnerabilities were published for netty.

CVE-2026-93488[0]:
| A flaw was found in Netty. SpdySessionHandler accepts an unlimited
| number of concurrent remote-initiated streams because
| localConcurrentStreams defaults to Integer.MAX_VALUE and the handler
| provides no API to change it. A remote peer can open a SPDY
| connection and send a large number of SYN_STREAM frames with
| FLAG_FIN=0, causing unbounded heap and direct memory allocation that
| can lead to JVM OutOfMemoryError and a denial of service.


CVE-2026-93491[1]:
| A flaw was found in Netty's HttpServerCodec. A remote,
| unauthenticated attacker can exploit this vulnerability by
| pipelining HTTP/1.1 requests on a single connection and withholding
| reads. This action causes the methodOverflowQueue to grow without
| limit, leading to unbounded heap memory consumption and a denial of
| service due to memory exhaustion.


CVE-2026-93492[2]:
| A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker
| can exploit this by sending HTTP/2 SETTINGS frames with a very large
| MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an
| excessive number of unique headers, leading to increased CPU usage
| and memory consumption, ultimately resulting in a Denial of Service
| (DoS).


CVE-2026-93493[3]:
| A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A
| remote attacker can exploit this vulnerability by providing an
| Online Certificate Status Protocol (OCSP) response that omits the
| optional `nextUpdate` field. This omission causes the OCSP
| validation to be silently skipped, leading to applications
| proceeding with an unvalidated certificate. This can result in a
| bypass of security controls where certificate validation is
| expected.


CVE-2026-93494[4]:
| A flaw was found in Netty's StompSubframeDecoder component. A remote
| attacker can exploit this vulnerability by sending a specially
| crafted STOMP frame body without its terminating null byte. This
| causes the decoder to allocate a ByteBuf (a buffer for bytes) that
| is never released, leading to a permanent memory leak. Over time,
| this uncontrolled memory consumption can result in a Denial of
| Service (DoS) for the application using the affected STOMP codec.


CVE-2026-93558[5]:
| A flaw was found in Netty's WebSocketServerExtensionHandler. A
| remote, unauthenticated attacker can exploit this vulnerability by
| using HTTP/1.1 pipelining to send requests faster than the
| application can respond. This leads to an unbounded growth of a per-
| connection queue, consuming excessive memory. Eventually, this can
| cause the Java Virtual Machine (JVM) to exhaust its heap, resulting
| in a Denial of Service (DoS) for the affected server.


CVE-2026-93560[6]:
| A flaw was found in the Netty STOMP codec. A remote attacker could
| send a specially crafted STOMP frame with a content-length header
| exceeding the maximum integer value. This integer truncation
| vulnerability could lead to an infinite decode loop, causing a
| Denial of Service (DoS) by exhausting memory and CPU resources.


CVE-2026-93561[7]:
| A flaw was found in io.netty/netty-codec-memcache. The Memcache
| binary protocol codec incorrectly reads `keyLength` and
| `extrasLength` as signed Java types instead of unsigned, as
| specified by the protocol. A malicious Memcache server can exploit
| this type mismatch by sending a specially crafted response. This can
| lead to frame desynchronization and response smuggling, where one
| client's data may be inadvertently exposed to another client's
| response stream in proxy or cache environments.


CVE-2026-93562[8]:
| A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of
| malformed Transfer-Encoding headers allows a remote attacker to
| perform HTTP request smuggling. By sending specially crafted HTTP
| requests, an attacker can inject arbitrary HTTP requests,
| potentially bypassing security controls or accessing unauthorized
| resources.


CVE-2026-93563[9]:
| A flaw was found in Netty's `SmtpResponseDecoder` component. A
| remote attacker, acting as a malicious or man-in-the-middle (MITM)
| SMTP server, could exploit this by sending a specially crafted,
| unbounded multi-line SMTP response without a terminator. This
| vulnerability leads to unbounded memory accumulation within the
| client's Java Virtual Machine (JVM) heap, causing an
| `OutOfMemoryError` and a denial of service (DoS) due to a process
| crash.


CVE-2026-93564[10]:
| A flaw was found in Netty. A reference-count leak in the HAProxy
| PROXY-v2 message decoder allows a remote, unauthenticated attacker
| to send specially crafted PROXY-protocol v2 headers. This can lead
| to memory exhaustion, resulting in a Denial of Service (DoS) for the
| affected system.


CVE-2026-93565[11]:
| A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()`
| function incorrectly strips trailing control bytes from method
| tokens in Real-Time Streaming Protocol (RTSP) requests. A remote
| attacker can exploit this by sending a specially crafted RTSP
| request, leading to method-token smuggling. This vulnerability
| allows an attacker to bypass method-based access controls and can
| also be used to launder malicious requests through Netty-based RTSP
| proxies, making them appear legitimate to backend systems.


CVE-2026-93566[12]:
| A flaw was found in Netty. A remote attacker could exploit this by
| sending a specially crafted HTTP request that includes control
| characters within the chunk-size line. This bypasses the intended
| strict validation, allowing the attacker to inject arbitrary HTTP
| requests. This vulnerability can lead to HTTP request smuggling,
| potentially resulting in information disclosure or other
| unauthorized actions.


CVE-2026-93567[13]:
| A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1
| CONNECT requests to HTTP/2, the component incorrectly uses the Host
| header instead of the CONNECT authority-form request-target for the
| tunnel authority. A remote attacker can exploit this by supplying a
| different Host header, leading to a malformed HTTP/2 CONNECT
| request. This can bypass security controls such as tunnel allow-
| lists or egress policies, resulting in integrity loss.


CVE-2026-93568[14]:
| A flaw was found in Netty. A remote attacker could exploit this
| vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended
| CONNECT requests. Netty's HTTP-object conversion path incorrectly
| processes these requests as regular HTTP/1.1 CONNECT requests,
| leading to a loss of critical protocol and path information. This
| misinterpretation can allow attackers to bypass security policies,
| such as routing or authorization logic, in applications that rely on
| Netty for HTTP/2 or HTTP/3 communication, resulting in integrity
| loss.


CVE-2026-93569[15]:
| A flaw was found in Netty. A remote unauthenticated attacker can
| exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion
| process. When an HTTP/1 request includes both an absolute-form
| request-target and a conflicting Host header, Netty incorrectly
| prioritizes the Host header for the HTTP/2 :authority field,
| discarding the original request-target authority. This inconsistency
| can allow an attacker to bypass security controls in Netty-based
| proxies or gateways, potentially leading to unauthorized access,
| cache poisoning, or misrouting of requests.


CVE-2026-93572[16]:
| A flaw was found in Netty's `RedisArrayAggregator` component. A
| remote attacker can exploit this vulnerability by sending specially
| crafted nested Redis (RESP) array headers. This can cause the
| `RedisArrayAggregator` to eagerly preallocate a large amount of heap
| memory, leading to heap memory exhaustion and a Denial of Service
| (DoS) for applications using `RedisDecoder` with
| `RedisArrayAggregator` on untrusted traffic.


CVE-2026-93573[17]:
| A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability
| allows a remote attacker to bypass `Transfer-Encoding` header
| validation by splitting the `Transfer-Encoding` field across
| multiple headers, with the last field containing a non-final
| transfer coding like `gzip` or `deflate`. This bypass can lead to
| HTTP request smuggling, enabling attackers to bypass security
| controls, desynchronize request processing, or cause requests to be
| processed in an unintended context.


CVE-2026-93574[18]:
| A flaw was found in Netty's `netty-codec-http` component. A remote
| attacker could exploit this vulnerability by sending a specially
| crafted HTTP/1.1 chunk-size token that includes post-digit
| whitespace. This incorrect parsing of the chunk size can lead to
| HTTP request smuggling. This allows an attacker to bypass security
| controls or access unauthorized resources in proxy/backend
| deployments.


CVE-2026-93575[19]:
| A flaw was found in Netty's MqttDecoder. An unauthenticated remote
| attacker can exploit this vulnerability by sending a specially
| crafted MQTT CONNECT packet. The decoder fails to properly validate
| the 'Properties Length' against the 'Remaining Length', allowing an
| attacker to bypass size limits. This leads to excessive memory and
| CPU consumption, resulting in a denial of service (DoS) due to an
| OutOfMemoryError.


CVE-2026-93576[20]:
| A flaw was found in Netty netty-codec-smtp. The component does not
| properly validate Carriage Return (CR) and Line Feed (LF) characters
| in the SMTP command-name field. A remote attacker, if an application
| routes untrusted input into this field, can embed CR/LF characters
| to inject arbitrary SMTP commands. This can lead to SMTP command
| smuggling, allowing for unauthorized email relay or spoofing of
| sender/recipient addresses. While the impact is significant, the
| real-world exploitability is considered lower as applications
| typically do not place user-controlled data in the command-name
| field.


CVE-2026-93578[21]:
| A flaw was found in Netty's Online Certificate Status Protocol
| (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning'
| Extended Key Usage (EKU) in OCSP responder certificates. A remote
| attacker, holding any valid certificate issued by the same
| Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP
| responses for revoked certificates. This bypasses certificate
| revocation checks, allowing applications using Netty's OCSP Client
| to accept certificates that should have been revoked, leading to an
| authorization bypass.


CVE-2026-93579[22]:
| A flaw was found in Netty's HTTP/2 stack. This vulnerability allows
| a remote attacker to inject prohibited characters, such as NUL, Line
| Feed, and Carriage Return, into HTTP/2 header field values due to
| insufficient validation. When these values cross an HTTP/2 to
| HTTP/1.1 translation boundary, they can be exploited for request
| smuggling, header injection, or response splitting. This could lead
| to unauthorized access, data manipulation, or other security
| bypasses.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-93488
https://www.cve.org/CVERecord?id=CVE-2026-93488
[1] https://security-tracker.debian.org/tracker/CVE-2026-93491
https://www.cve.org/CVERecord?id=CVE-2026-93491
[2] https://security-tracker.debian.org/tracker/CVE-2026-93492
https://www.cve.org/CVERecord?id=CVE-2026-93492
[3] https://security-tracker.debian.org/tracker/CVE-2026-93493
https://www.cve.org/CVERecord?id=CVE-2026-93493
[4] https://security-tracker.debian.org/tracker/CVE-2026-93494
https://www.cve.org/CVERecord?id=CVE-2026-93494
[5] https://security-tracker.debian.org/tracker/CVE-2026-93558
https://www.cve.org/CVERecord?id=CVE-2026-93558
[6] https://security-tracker.debian.org/tracker/CVE-2026-93560
https://www.cve.org/CVERecord?id=CVE-2026-93560
[7] https://security-tracker.debian.org/tracker/CVE-2026-93561
https://www.cve.org/CVERecord?id=CVE-2026-93561
[8] https://security-tracker.debian.org/tracker/CVE-2026-93562
https://www.cve.org/CVERecord?id=CVE-2026-93562
[9] https://security-tracker.debian.org/tracker/CVE-2026-93563
https://www.cve.org/CVERecord?id=CVE-2026-93563
[10] https://security-tracker.debian.org/tracker/CVE-2026-93564
https://www.cve.org/CVERecord?id=CVE-2026-93564
[11] https://security-tracker.debian.org/tracker/CVE-2026-93565
https://www.cve.org/CVERecord?id=CVE-2026-93565
[12] https://security-tracker.debian.org/tracker/CVE-2026-93566
https://www.cve.org/CVERecord?id=CVE-2026-93566
[13] https://security-tracker.debian.org/tracker/CVE-2026-93567
https://www.cve.org/CVERecord?id=CVE-2026-93567
[14] https://security-tracker.debian.org/tracker/CVE-2026-93568
https://www.cve.org/CVERecord?id=CVE-2026-93568
[15] https://security-tracker.debian.org/tracker/CVE-2026-93569
https://www.cve.org/CVERecord?id=CVE-2026-93569
[16] https://security-tracker.debian.org/tracker/CVE-2026-93572
https://www.cve.org/CVERecord?id=CVE-2026-93572
[17] https://security-tracker.debian.org/tracker/CVE-2026-93573
https://www.cve.org/CVERecord?id=CVE-2026-93573
[18] https://security-tracker.debian.org/tracker/CVE-2026-93574
https://www.cve.org/CVERecord?id=CVE-2026-93574
[19] https://security-tracker.debian.org/tracker/CVE-2026-93575
https://www.cve.org/CVERecord?id=CVE-2026-93575
[20] https://security-tracker.debian.org/tracker/CVE-2026-93576
https://www.cve.org/CVERecord?id=CVE-2026-93576
[21] https://security-tracker.debian.org/tracker/CVE-2026-93578
https://www.cve.org/CVERecord?id=CVE-2026-93578
[22] https://security-tracker.debian.org/tracker/CVE-2026-93579
https://www.cve.org/CVERecord?id=CVE-2026-93579

Regards,
Salvatore