netty-tcnative: This update for netty, netty-tcnative fixes the following issues: - CVE-2026-59902: Netty: Memory Exhaustion in Sctp...

This update for netty, netty-tcnative fixes the following issues: - CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501). - CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite (bsc#1275500). - CVE-2026-62243: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455). - CVE-2026-62380: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456). - CVE-2026-75595: fragmented TLS `ClientHello` causes fallback to default `SslContext` and allows for SNI routing and mTLS requirement bypass (bsc#1276420). - CVE-2026-75596: fragmented `ClientHello`records can trigger quadratic pre-handshake reassembly in default SNI parsing (bsc#1276421). - CVE-2026-76816: missing input validation in `MqttEncoder` allows for null-byte injection, topic hijacking, and ACL bypassing (bsc#1277243). - CVE-2026-89044: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding (bsc#1280048). - CVE-2026-93488: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084). - CVE-2026-93491: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085). - CVE-2026-93492: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132). - CVE-2026-93493: missing `nextUpdate` field in OCSP responses leads to silent validation bypass (bsc#1281431). - CVE-2026-93494: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506). - CVE-2026-93558: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service (bsc#1282140). - CVE-2026-93560: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141). - CVE-2026-93562: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362). - CVE-2026-93563: unbounded multi-line response accumulation in `SmtpResponseDecoder` leads to memory exhaustion and a DoS (bsc#1281432). - CVE-2026-93564: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363). - CVE-2026-93565: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364). - CVE-2026-93566: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366). - CVE-2026-93567: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority (bsc#1282367). - CVE-2026-93568: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370). - CVE-2026-93569: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority (bsc#1282372). - CVE-2026-93572: multiplication of patched preallocation limits in `RedisArrayAggregator` nested RESP headers can lead to denial of service (bsc#1281433). - CVE-2026-93573: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373). - CVE-2026-93574: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374). - CVE-2026-93575: missing validations in the `MqttDecoder` can lead to excessive resource consumption and a DoS (bsc#1281434). - CVE-2026-93576: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507). - CVE-2026-93578: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass (bsc#1281435). - CVE-2026-93579: HTTP/2 header field values are not validated by default (bsc#1282378). Changes for netty: - Upgrade to upstream version 4.1.138 Changes for netty-tcnative: - Upgrade to version 2.0.84 Final

Where it's fixed