{"schema_version":"1","data":[{"id":29871,"advisory_id":"fb242ebc-6734-4010-b9cf-6ab7771815f1","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93574","source_published_at":"2026-09-18T20:12:43.146+00:00","published_at":"2026-10-25T08:06:22.035415+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93574"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing","summary":"A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.","evidence":"cve:CVE-2026-93574","products":[{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93574","aliases":["CVE-2026-93574"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T17:01:26.141Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93574","https://bugzilla.redhat.com/show_bug.cgi?id=2536966"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93574","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T18:18:47.806786Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T18:19:07.477Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T17:01:26.141Z"}}},"related_cves":[{"value":"CVE-2026-93574","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29870,"advisory_id":"5bd1d8bb-4751-4354-9018-b00b2c99cd45","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93562","source_published_at":"2026-09-18T20:12:51.91+00:00","published_at":"2026-10-25T08:06:21.44339+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93562"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling","summary":"A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.","evidence":"cve:CVE-2026-93562","products":[{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93562","aliases":["CVE-2026-93562"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T17:01:19.905Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93562","https://bugzilla.redhat.com/show_bug.cgi?id=2536951"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93562","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-22T16:17:26.080353Z"}}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536951","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-22T16:17:31.584Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T17:01:19.905Z"}}},"related_cves":[{"value":"CVE-2026-93562","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29868,"advisory_id":"0d1e23b1-aeb6-4909-b405-7a7d27adbd54","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93566","source_published_at":"2026-09-18T14:19:29.741+00:00","published_at":"2026-10-25T08:06:20.852904+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93566"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line","summary":"A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.","evidence":"cve:CVE-2026-93566","products":[{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93566","aliases":["CVE-2026-93566"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T17:01:19.077Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93566","https://bugzilla.redhat.com/show_bug.cgi?id=2536954"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93566","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-22T14:28:28.241291Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-22T14:28:43.220Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T17:01:19.077Z"}}},"related_cves":[{"value":"CVE-2026-93566","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29867,"advisory_id":"b9bb6ece-ea77-4b82-8210-e0e85272e964","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93573","source_published_at":"2026-09-18T14:44:00.077+00:00","published_at":"2026-10-25T08:06:20.250488+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93573"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling","summary":"A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context.","evidence":"cve:CVE-2026-93573","products":[{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-93573","aliases":["CVE-2026-93573"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"LOW"}}],"affected":[{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"}],"modified":"2026-10-15T17:01:20.443Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93573","https://bugzilla.redhat.com/show_bug.cgi?id=2536964"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93573","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T16:19:54.114434Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T16:20:09.086Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T17:01:20.443Z"}}},"related_cves":[{"value":"CVE-2026-93573","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29851,"advisory_id":"ba32010f-7f17-4a89-8e6c-d27f1ed65207","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93565","source_published_at":"2026-09-18T14:18:11.431+00:00","published_at":"2026-10-25T08:06:10.077679+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93565"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte","summary":"A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.","evidence":"cve:CVE-2026-93565","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93565","aliases":["CVE-2026-93565"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"4.1.138.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.netty/netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T16:42:40.628Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93565","https://bugzilla.redhat.com/show_bug.cgi?id=2536952"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93565","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-21T19:48:34.585168Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-21T20:51:46.984Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T16:42:40.628Z"}}},"related_cves":[{"value":"CVE-2026-93565","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29850,"advisory_id":"a2203524-5c2d-49b7-bdf9-74e0671ad344","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93564","source_published_at":"2026-09-18T14:13:32.128+00:00","published_at":"2026-10-25T08:06:09.45029+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93564"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)","summary":"A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system.","evidence":"cve:CVE-2026-93564","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93564","aliases":["CVE-2026-93564"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"4.1.138.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.netty/netty-codec-haproxy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-haproxy","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T16:42:37.896Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93564","https://bugzilla.redhat.com/show_bug.cgi?id=2536953"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93564","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T17:42:29.142695Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T17:42:41.325Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T16:42:37.896Z"}}},"related_cves":[{"value":"CVE-2026-93564","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29849,"advisory_id":"b83c1009-7f66-484f-954e-76d34f70bdc1","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93558","source_published_at":"2026-09-18T14:09:01.96+00:00","published_at":"2026-10-25T08:06:08.820912+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93558"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service","summary":"A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server.","evidence":"cve:CVE-2026-93558","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93558","aliases":["CVE-2026-93558"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"4.1.138.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.netty/netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T16:42:33.129Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93558","https://bugzilla.redhat.com/show_bug.cgi?id=2536932"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93558","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T14:54:07.542588Z"}}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2536932","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T14:54:19.353Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T16:42:33.129Z"}}},"related_cves":[{"value":"CVE-2026-93558","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29848,"advisory_id":"49f02c88-9eef-44f0-af01-8ebffec22ec7","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93491","source_published_at":"2026-09-18T12:43:26.091+00:00","published_at":"2026-10-25T08:06:08.223859+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93491"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue","summary":"A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion.","evidence":"cve:CVE-2026-93491","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93491","aliases":["CVE-2026-93491"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"4.1.138.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.netty/netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T16:42:28.138Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93491","https://bugzilla.redhat.com/show_bug.cgi?id=2536891","https://github.com/netty/netty/releases/tag/netty-4.1.138.Final","https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93491","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T19:06:39.794513Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T19:06:57.127Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T16:42:28.138Z"}}},"related_cves":[{"value":"CVE-2026-93491","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":29847,"advisory_id":"411cdbd8-3d81-483b-ad0f-81394ea2305d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93488","source_published_at":"2026-09-18T11:47:52.574+00:00","published_at":"2026-10-25T08:06:07.637889+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-amq-clients","red-hat-build-of-apache-camel-3-33-3-sp2","red-hat-build-of-apache-camel-4-for-quarkus-3","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-build-of-apicurio-registry-3","red-hat-build-of-debezium-3-6","red-hat-build-of-keycloak","red-hat-build-of-quarkus-3-27-5-sp2","red-hat-build-of-quarkus-3-33-3-sp2","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-8","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93488"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams","summary":"A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service.","evidence":"cve:CVE-2026-93488","products":[{"name":{"value":"Red Hat Build of Apache Camel 3.33.3.SP2","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Debezium 3.6","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.27.5.SP2","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Quarkus 3.33.3.SP2","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Clients","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel 4 for Quarkus 3","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apicurio Registry 3","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Build of Keycloak","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93488","aliases":["CVE-2026-93488"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:apache_camel_quarkus:3.33"],"vendor":"Red Hat","product":"Red Hat Build of Apache Camel 3.33.3.SP2","versions":[{"status":"unaffected","version":"4.1.138.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"io.netty/netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:debezium:3.6"],"vendor":"Red Hat","product":"Red Hat Build of Debezium 3.6","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.27::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.27.5.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:quarkus:3.33::el8"],"vendor":"Red Hat","product":"Red Hat build of Quarkus 3.33.3.SP2","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_clients:2023"],"vendor":"Red Hat","product":"Red Hat AMQ Clients","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_quarkus:3"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel 4 for Quarkus 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:apicurio_registry:3"],"vendor":"Red Hat","product":"Red Hat build of Apicurio Registry 3","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:build_keycloak:"],"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unknown"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-http","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-10-15T16:42:26.266Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:69440","https://access.redhat.com/errata/RHSA-2026:69470","https://access.redhat.com/errata/RHSA-2026:70257","https://access.redhat.com/errata/RHSA-2026:83612","https://access.redhat.com/security/cve/CVE-2026-93488","https://bugzilla.redhat.com/show_bug.cgi?id=2536887","https://github.com/netty/netty/releases/tag/netty-4.1.138.Final","https://github.com/netty/netty/releases/tag/netty-4.2.18.Final"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93488","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-18T14:56:31.822535Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-18T14:56:42.825Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-15T16:42:26.266Z"}}},"related_cves":[{"value":"CVE-2026-93488","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":9414,"advisory_id":"8cdcbb41-d73c-40df-9d29-e11bae35168d","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-0603","source_published_at":"2026-01-23T06:31:38.975+00:00","published_at":"2026-10-24T23:17:30.828898+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-build-of-optaplanner-8","red-hat-data-grid-8","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-jboss-enterprise-application-platform-7-1-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-3-eus-for-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-24","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-7","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-8","red-hat-jboss-enterprise-application-platform-7-4-els-on-rhel-9","red-hat-jboss-enterprise-application-platform-8","red-hat-jboss-enterprise-application-platform-expansion-pack","red-hat-openshift-ai-rhoai","red-hat-openshift-dev-spaces","red-hat-process-automation-7","red-hat-satellite-6","red-hat-single-sign-on-7-6-13","red-hat-single-sign-on-7-6-for-rhel-7","red-hat-single-sign-on-7-6-for-rhel-8","red-hat-single-sign-on-7-6-for-rhel-9","rhel-8-based-middleware-containers"],"cve_ids":["CVE-2026-0603"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Org.hibernate/hibernate-core: hibernate: information disclosure and data deletion via second-order sql injection","summary":"A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.","evidence":"cve:CVE-2026-0603","products":[{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4.24","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","evidence":"/containers/cna/affected/8/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","evidence":"/containers/cna/affected/9/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","evidence":"/containers/cna/affected/10/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","evidence":"/containers/cna/affected/11/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6.13","evidence":"/containers/cna/affected/12/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 7","evidence":"/containers/cna/affected/13/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 8","evidence":"/containers/cna/affected/14/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7.6 for RHEL 9","evidence":"/containers/cna/affected/15/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"RHEL-8 based Middleware Containers","evidence":"/containers/cna/affected/16/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/17/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of OptaPlanner 8","evidence":"/containers/cna/affected/18/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Data Grid 8","evidence":"/containers/cna/affected/19/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/20/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/21/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 8","evidence":"/containers/cna/affected/22/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform Expansion Pack","evidence":"/containers/cna/affected/23/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/24/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift AI (RHOAI)","evidence":"/containers/cna/affected/25/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/26/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat OpenShift Dev Spaces","evidence":"/containers/cna/affected/27/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Process Automation 7","evidence":"/containers/cna/affected/28/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Satellite 6","evidence":"/containers/cna/affected/29/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Satellite 6","evidence":"/containers/cna/affected/30/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-0603","aliases":["CVE-2026-0603"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"versions":[{"status":"affected","version":"5.2.8","versionType":"semver","lessThanOrEqual":"5.6.15"}],"packageName":"org.hibernate/hibernate-core","collectionURL":"https://github.com/hibernate/hibernate-orm","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:5.1.17-4.Final_redhat_00005.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.1.14-4.GA_redhat_00003.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.3.17-5.GA_redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7.4"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4.24","versions":[{"status":"unaffected","version":"5.3.38.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"org.hibernate/hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6.13","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 7","versions":[{"status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el7sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el8"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 8","versions":[{"status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el8sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7.6::el9"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7.6 for RHEL 9","versions":[{"status":"unaffected","version":"0:18.0.20-1.redhat_00001.1.el9sso","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso7-keycloak","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:rhosemc:1.0::el8"],"vendor":"Red Hat","product":"RHEL-8 based Middleware Containers","versions":[{"status":"unaffected","version":"7.6-85","lessThan":"*","versionType":"rpm"}],"packageName":"rh-sso-7/sso76-openshift-rhel8","collectionURL":"https://catalog.redhat.com/software/containers/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:optaplanner:::el6"],"vendor":"Red Hat","product":"Red Hat build of OptaPlanner 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/openvsx-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/pluginregistry-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:satellite:6"],"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"candlepin","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:satellite:6"],"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"satellite:el8/candlepin","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"}],"modified":"2026-10-06T16:58:42.598Z","provider":"cve","references":["https://access.redhat.com/errata/RHSA-2026:4915","https://access.redhat.com/errata/RHSA-2026:4916","https://access.redhat.com/errata/RHSA-2026:4917","https://access.redhat.com/errata/RHSA-2026:4924","https://access.redhat.com/errata/RHSA-2026:6011","https://access.redhat.com/errata/RHSA-2026:6012","https://access.redhat.com/errata/RHSA-2026:76128","https://access.redhat.com/errata/RHSA-2026:76129","https://access.redhat.com/errata/RHSA-2026:76130","https://access.redhat.com/errata/RHSA-2026:76132","https://access.redhat.com/errata/RHSA-2026:76134","https://access.redhat.com/security/cve/CVE-2026-0603","https://bugzilla.redhat.com/show_bug.cgi?id=2427147"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-0603","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-24T04:55:25.177681Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-02-26T14:44:24.608Z"}},{"title":"org.hibernate/hibernate-core: Hibernate: Information disclosure and data deletion via second-order SQL injection","metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:5.1.17-4.Final_redhat_00005.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.1::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.1.14-4.GA_redhat_00003.1.ep7.el7","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_eus:7.3::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7","versions":[{"status":"unaffected","version":"0:7.3.17-5.GA_redhat_00006.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4.24","versions":[{"status":"unaffected","version":"5.3.38.Final-redhat-00001","lessThan":"*","versionType":"rpm"}],"packageName":"org.hibernate/hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el7eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el8eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:5.3.38-1.Final_redhat_00001.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-hibernate","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el9"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9","versions":[{"status":"unaffected","version":"0:7.4.24-4.GA_redhat_00002.1.el9eap","lessThan":"*","versionType":"rpm"}],"packageName":"eap7-wildfly","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:optaplanner:::el6"],"vendor":"Red Hat","product":"Red Hat build of OptaPlanner 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_data_grid:8"],"vendor":"Red Hat","product":"Red Hat Data Grid 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jbosseapxp"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel8","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_ai"],"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-trustyai-service-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/openvsx-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:openshift_devspaces:3"],"vendor":"Red Hat","product":"Red Hat OpenShift Dev Spaces","packageName":"devspaces/pluginregistry-rhel9","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_bpms_platform:7"],"vendor":"Red Hat","product":"Red Hat Process Automation 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:satellite:6"],"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"candlepin","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:satellite:6"],"vendor":"Red Hat","product":"Red Hat Satellite 6","packageName":"satellite:el8/candlepin","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"hibernate-core","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"timeline":[{"lang":"en","time":"2026-01-05T13:12:29.816Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-01-19T10:10:00.000Z","value":"Made public."}],"solutions":[{"lang":"en","value":"RHSA-2026:6012: Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server"},{"lang":"en","value":"RHSA-2026:6011: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server"},{"lang":"en","value":"RHSA-2026:4915: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"},{"lang":"en","value":"RHSA-2026:4916: Red Hat JBoss EAP 7.4 ELS for RHEL 8"},{"lang":"en","value":"RHSA-2026:4917: Red Hat JBoss EAP 7.4 ELS for RHEL 9"},{"lang":"en","value":"RHSA-2026:4924: Red Hat JBoss Enterprise Application Platform 7.4.24"}],"x_adpType":"supplier","datePublic":"2026-01-19T10:10:00.000Z","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-0603","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427147","name":"RHBZ#2427147","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0603.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6012","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6011","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4915","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4916","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4917","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:4924","tags":["vendor-advisory","x_refsource_REDHAT"]}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_generator":{"engine":"sadp-cli 1.0.0"},"descriptions":[{"lang":"en","value":"A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service."}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-89","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}],"providerMetadata":{"orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","shortName":"redhat-SADP","dateUpdated":"2026-09-14T12:04:32.444Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-10-06T16:58:42.598Z"}}},"related_cves":[{"value":"CVE-2026-0603","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}},{"id":2004,"advisory_id":"5b090f6f-d5ae-461b-abdc-9ab4302af959","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-93575","source_published_at":"2026-09-18T10:53:48.089+00:00","published_at":"2026-10-24T21:11:16.694235+00:00","extraction_method":"structured","technologies":["core-cve","red-hat-amq-broker-7","red-hat-build-of-apache-camel-for-spring-boot-4","red-hat-fuse-7","red-hat-jboss-enterprise-application-platform-7","red-hat-single-sign-on-7"],"cve_ids":["CVE-2026-93575"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"Io.netty/netty-codec-mqtt: netty: resource exhaustion in mqttdecoder","summary":"A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError.","evidence":"cve:CVE-2026-93575","products":[{"name":{"value":"Red Hat AMQ Broker 7","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat build of Apache Camel for Spring Boot 4","evidence":"/containers/cna/affected/1/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Fuse 7","evidence":"/containers/cna/affected/2/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/3/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/4/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/5/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat JBoss Enterprise Application Platform 7","evidence":"/containers/cna/affected/6/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"Red Hat Single Sign-On 7","evidence":"/containers/cna/affected/7/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-93575","aliases":["CVE-2026-93575"],"metrics":[{"other":{"type":"Red Hat severity rating","content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"}}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"cpes":["cpe:/a:redhat:amq_broker:7"],"vendor":"Red Hat","product":"Red Hat AMQ Broker 7","packageName":"netty-codec-mqtt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:camel_spring_boot:4"],"vendor":"Red Hat","product":"Red Hat build of Apache Camel for Spring Boot 4","packageName":"netty-codec-mqtt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_fuse:7"],"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"netty-codec-mqtt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"unaffected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"jboss-eap-7/eap74-els-openjdk11-openshift-rhel8","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"jboss-eap-7/eap74-els-openjdk17-openshift-rhel8","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"jboss-eap-7/eap74-els-openjdk8-openshift-rhel8","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"],"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"netty-codec-mqtt","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","defaultStatus":"affected"},{"cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"],"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","packageName":"netty-codec-mqtt","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","defaultStatus":"affected"}],"modified":"2026-09-25T08:29:03.072Z","provider":"cve","references":["https://access.redhat.com/security/cve/CVE-2026-93575","https://bugzilla.redhat.com/show_bug.cgi?id=2536967"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-93575","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-22T14:18:05.993557Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-22T14:18:56.894Z"}}],"cna":{"orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat","dateUpdated":"2026-09-25T08:29:03.072Z"}}},"related_cves":[{"value":"CVE-2026-93575","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"}}],"next_after":29871,"next_before":2004}