[Git][security-tracker-team/security-tracker][master] Add new netty-tcnative issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
26c8498f by Salvatore Bonaccorso at 2026-10-27T06:23:48+01:00
Add new netty-tcnative issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -188,13 +188,21 @@ CVE-2026-116544 (Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vuln
 CVE-2026-116543 (Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulner ...)
 	- open5gs <itp> (bug #1094791)
 CVE-2026-116542 (Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoo ...)
-	TODO: check
+	- netty-tcnative <unfixed>
+	NOTE: https://github.com/netty/netty-tcnative/security/advisories/GHSA-2784-hxmm-4hgf
+	NOTE: Fixed by: https://github.com/netty/netty-tcnative/commit/a879c85b9776cf478aada3ca69e60b8c0a99ed38 (netty-tcnative-parent-2.0.84.Final)
 CVE-2026-116541 (Netty netty-tcnative before 2.0.84.Final contains a denial of service  ...)
-	TODO: check
+	- netty-tcnative <unfixed>
+	NOTE: https://github.com/netty/netty-tcnative/security/advisories/GHSA-9xr3-jwv4-r489
+	NOTE: Fixed by: https://github.com/netty/netty-tcnative/commit/e31df4a5885b35085fdfa3e2dca7c1f705d4745b (netty-tcnative-parent-2.0.84.Final)
 CVE-2026-116540 (netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL  ...)
-	TODO: check
+	- netty-tcnative <unfixed>
+	NOTE: https://github.com/netty/netty-tcnative/security/advisories/GHSA-mmc8-vg2v-fvvw
+	NOTE: Fixed by: https://github.com/netty/netty-tcnative/commit/59662a8b07a9a7623ae1bc472f5751f31c81a118 (netty-tcnative-parent-2.0.84.Final)
 CVE-2026-116539 (Netty netty-tcnative before 2.0.84.Final contains a heap buffer overfl ...)
-	TODO: check
+	- netty-tcnative <unfixed>
+	NOTE: https://github.com/netty/netty-tcnative/security/advisories/GHSA-gf9q-9mg7-g5qh
+	NOTE: Fixed by: https://github.com/netty/netty-tcnative/commit/92dd66fd1243d85c05a61288f96367a70260b6b8 (netty-tcnative-parent-2.0.84.Final)
 CVE-2026-116538 (HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-be ...)
 	NOT-FOR-US: HtmlSanitizer
 CVE-2026-116516 (Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zo ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26c8498f9994b8f73a3a4142bdf3b98e92d25000

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26c8498f9994b8f73a3a4142bdf3b98e92d25000
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/703fe8fd/attachment.htm>