[Git][security-tracker-team/security-tracker][master] Add new batch of netty issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e686ef4b by Salvatore Bonaccorso at 2026-09-26T22:23:51+02:00
Add new batch of netty issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -164,29 +164,41 @@ CVE-2026-100668 (Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape
 CVE-2026-100667 (grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and <  ...)
 	NOT-FOR-US: Grav CMS plugin
 CVE-2026-100666 (Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0. ...)
-	TODO: check
+	- netty <unfixed>
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-2g6j-r8q9-5hr8
 CVE-2026-100665 (Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomp ...)
-	TODO: check
+	- netty <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387
 CVE-2026-100664 (Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final ...)
-	TODO: check
+	- netty <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h
 CVE-2026-100663 (Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final thr ...)
-	TODO: check
+	- netty <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627
 CVE-2026-100662 (Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final ...)
-	TODO: check
+	- netty <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w
 CVE-2026-100661 (Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final ...)
-	TODO: check
+	- netty <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx
 CVE-2026-100660 (Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final thr ...)
-	TODO: check
+	- netty <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc
 CVE-2026-100659 (Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Fi ...)
-	TODO: check
+	- netty <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm
 CVE-2026-100658 (Netty (io.netty:netty-codec-http) contains an unbounded per-connection ...)
-	TODO: check
+	- netty <not-affected> (Vulnerable code not present)
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc
 CVE-2026-100657 (Netty's STOMP codec (io.netty:netty-codec-stomp) contains a ByteBuf le ...)
-	TODO: check
+	- netty <unfixed>
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j
 CVE-2026-100656 (Netty (io.netty:netty-codec-http) contains an unbounded per-connection ...)
-	TODO: check
+	- netty <unfixed>
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq
 CVE-2026-100655 (Netty (io.netty:netty-codec-http) versions up to and including 4.1.137 ...)
-	TODO: check
+	- netty <unfixed>
+	NOTE: https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7
 CVE-2026-100654 (vLLM before 0.29.0 accepts user-controlled stop_token_ids on the OpenA ...)
 	- vllm <itp> (bug #1095237)
 CVE-2026-100653 (vLLM is an inference and serving engine for large language models. In  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e686ef4b7072c007b4d8aaed622a66697054587b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e686ef4b7072c007b4d8aaed622a66697054587b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260926/06b64af1/attachment-0001.htm>