UnratedFix available
netty-4.2.15.Final
Type: patchSources: Netty
Netty 4.2.15.Final lists security fixes involving multiple Netty modules.
- Products
- io.netty:netty-codec-classes-quic, io.netty:netty-codec-haproxy, io.netty:netty-codec-http, io.netty:netty-codec-http2, io.netty:netty-codec-http3, io.netty:netty-codec-redis, io.netty:netty-handler, io.netty:netty-resolver-dns, io.netty:netty-transport-native-epoll, io.netty:netty-transport-native-kqueue, io.netty:netty-transport-sctp
- Affected versions
- Not specified
- Fixed versions
- netty-4.2.15.Final
- CVEs
- CVE-2026-44249, CVE-2026-44250, CVE-2026-44890, CVE-2026-44892, CVE-2026-44893, CVE-2026-44894, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-46340, CVE-2026-47244, CVE-2026-47691, CVE-2026-48006, CVE-2026-48043, CVE-2026-48059, CVE-2026-48748, CVE-2026-50009, CVE-2026-50010, CVE-2026-50011, CVE-2026-50020, CVE-2026-50560
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 29 Oct 2026, 09:18 UTC · Revision 1
Source evidence
Netty 4.2.15.Final lists security fixes involving multiple Netty modules.
Release notes from netty netty-4.2.15.Final Security fixes
io.netty:netty-codec-haproxy
Fixed versions: netty-4.2.15.Final
io.netty:netty-resolver-dns
Fixed versions: netty-4.2.15.Final
io.netty:netty-codec-http2
Fixed versions: netty-4.2.15.Final
io.netty:netty-codec-redis
Fixed versions: netty-4.2.15.Final
io.netty:netty-codec-classes-quic
Fixed versions: netty-4.2.15.Final
io.netty:netty-handler
Fixed versions: netty-4.2.15.Final
io.netty:netty-codec-http
Fixed versions: netty-4.2.15.Final
io.netty:netty-codec-http3
Fixed versions: netty-4.2.15.Final
io.netty:netty-transport-native-epoll
Fixed versions: netty-4.2.15.Final
io.netty:netty-transport-native-kqueue
Fixed versions: netty-4.2.15.Final
io.netty:netty-transport-sctp
Fixed versions: netty-4.2.15.Final
Complete source record
{
"id": "4d9d2aef9d09fd772010e2bbf610151b695d18dd8e39f4482dcfe5e19865b73e",
"url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final",
"method": "llm",
"payload": {
"kind": "patch",
"title": "netty-4.2.15.Final",
"summary": "Netty 4.2.15.Final lists security fixes involving multiple Netty modules.",
"evidence": "Release notes from netty\nnetty-4.2.15.Final\n\nSecurity fixes",
"products": [
{
"name": {
"value": "io.netty:netty-codec-haproxy",
"evidence": "CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-resolver-dns",
"evidence": "CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-codec-http2",
"evidence": "CVE-2026-50560: DDoS in io.netty:netty-codec-http2"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-codec-redis",
"evidence": "CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-codec-classes-quic",
"evidence": "CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-handler",
"evidence": "CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high)"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-codec-http",
"evidence": "CVE-2026-50020: request smuggling in io.netty:netty-codec-http"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-codec-http3",
"evidence": "CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high)"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-transport-native-epoll",
"evidence": "CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue."
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-transport-native-kqueue",
"evidence": "CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue."
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
},
{
"name": {
"value": "io.netty:netty-transport-sctp",
"evidence": "CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high)"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "netty-4.2.15.Final",
"evidence": "netty-4.2.15.Final\n\nSecurity fixes"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"fixed_cves": [],
"related_cves": [
{
"value": "CVE-2026-48059",
"evidence": "CVE-2026-48059: memory exhaustion in io.netty:netty-codec-haproxy"
},
{
"value": "CVE-2026-47691",
"evidence": "CVE-2026-47691: DNS cache poisoning in io.netty:netty-resolver-dns"
},
{
"value": "CVE-2026-50560",
"evidence": "CVE-2026-50560: DDoS in io.netty:netty-codec-http2."
},
{
"value": "CVE-2026-50011",
"evidence": "CVE-2026-50011: memory exhaustion in io.netty:netty-codec-redis"
},
{
"value": "CVE-2026-44250",
"evidence": "CVE-2026-44250: memory exhaustion in io.netty:netty-codec-redis"
},
{
"value": "CVE-2026-44890",
"evidence": "CVE-2026-44890: memory exhaustion in io.netty:netty-codec-redis"
},
{
"value": "CVE-2026-50009",
"evidence": "CVE-2026-50009: information disclosure and denial of service in io.netty:netty-codec-classes-quic"
},
{
"value": "CVE-2026-44249",
"evidence": "CVE-2026-44249: IPv6 subnet filter bypass in io.netty:netty-handler (high)"
},
{
"value": "CVE-2026-50020",
"evidence": "CVE-2026-50020: request smuggling in io.netty:netty-codec-http"
},
{
"value": "CVE-2026-44892",
"evidence": "CVE-2026-44892: memory exhaustion in io.netty:netty-codec-http3 (high)"
},
{
"value": "CVE-2026-44893",
"evidence": "CVE-2026-44893: memory leak in io.netty:netty-codec-haproxy (high)"
},
{
"value": "CVE-2026-44894",
"evidence": "CVE-2026-44894: traffic amplification in io.netty:netty-codec-classes-quic (high)"
},
{
"value": "CVE-2026-50010",
"evidence": "CVE-2026-50010: TLS hostname verification accidentally disabled in io.netty:netty-handler (high)"
},
{
"value": "CVE-2026-45673",
"evidence": "CVE-2026-45673: DNS cache poisoning in io.netty:netty-resolver-dns."
},
{
"value": "CVE-2026-45416",
"evidence": "CVE-2026-45416: excessive memory usage from SNIHandler in io.netty:netty-handler (high)"
},
{
"value": "CVE-2026-45536",
"evidence": "CVE-2026-45536: file descriptor leak in io.netty:netty-transport-native-epoll and io.netty:netty-transport-native-kqueue."
},
{
"value": "CVE-2026-45674",
"evidence": "CVE-2026-45674: DNS cache poisoning in io.netty:netty-resolver-dns (high)"
},
{
"value": "CVE-2026-46340",
"evidence": "CVE-2026-46340: memory exhaustion in io.netty:netty-transport-sctp (high)"
},
{
"value": "CVE-2026-47244",
"evidence": "CVE-2026-47244: denial of service in io.netty:netty-codec-http2."
},
{
"value": "CVE-2026-48006",
"evidence": "CVE-2026-48006: memory exhaustion in io.netty:netty-codec-redis (high)"
},
{
"value": "CVE-2026-48748",
"evidence": "CVE-2026-48748: memory exhaustion in io.netty:netty-codec-http3 (high)"
},
{
"value": "CVE-2026-48043",
"evidence": "CVE-2026-48043: memory exhaustion in io.netty:netty-codec-http2."
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "github-netty-netty",
"document_id": 21864,
"published_at": "2026-06-08T16:23:48+00:00"
}