VDB
RHSA-2026:50085
RHSA-2026:50085
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 |
Timeline
- Aug 4, 2026 CVE Published
- Sep 2, 2026 CVE Updated
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50085 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1 advisory
- https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html-single/red_hat_jboss_eap_xp_6.0_release_notes/index advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2477220 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488053 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488062 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488081 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488383 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488386 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488388 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488391 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488394 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488399 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488400 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488407 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488413 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488421 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488429 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2488433 issue
…and 84 more