{
  "cveId": "CVE-2026-33870",
  "url": "https://patchblox.com/security/cve/CVE-2026-33870",
  "summary": "CVE-2026-33870 is fixed in 2 products on 1 platform, first by SUSE-SU-2026:1353-1, released April 15, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "netty: This update for netty, netty-tcnative fixes the following issues:\n\nUpidate to 4.1.132:\n\n- CVE-2026-33870: incorrectly...",
  "description": "This update for netty, netty-tcnative fixes the following issues:\n\nUpidate to 4.1.132:\n\n- CVE-2026-33870: incorrectly parses quoted strings in HTTP/1.1 can lead to request smuggling (bsc#1261031).\n- CVE-2026-33871: sending a flood of CONTINUATION frames can lead to a denial of service (bsc#1261043).\n\nChangelog:\n\n- Upgrade to upstream version 4.1.132\n * Fixes:\n \u002B Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR\n retry loop\n \u002B Make RefCntOpenSslContext.deallocate more robust\n \u002B HTTP2: Correctly account for padding when decompress\n \u002B Fix high-order bit aliasing in HttpUtil.validateToken\n \u002B fix: the precedence of \u002B is higher than \u003E\u003E\n \u002B AdaptiveByteBufAllocator: make sure byteBuf.capacity() not\n greater than byteBuf.maxCapacity()\n \u002B AdaptivePoolingAllocator: call unreserveMatchingBuddy(...)\n if byteBuf initialization failed\n \u002B Don\u0027t assume CertificateFactory is thread-safe\n \u002B Fix HttpObjectAggregator leaving connection stuck after 413\n with AUTO_READ=false\n \u002B HTTP2: Ensure preface is flushed in all cases\n \u002B Fix UnsupportedOperationException in readTrailingHeaders\n \u002B Fix client_max_window_bits parameter handling in\n permessage-deflate extension\n \u002B Native transports: Fix possible fd leak when fcntl fails.\n \u002B Kqueue: Fix undefined behaviour when GetStringUTFChars fails\n and SO_ACCEPTFILTER is supported\n \u002B Kqueue: Possible overflow when using\n netty_kqueue_bsdsocket_setAcceptFilter(...)\n \u002B Native transports: Fix undefined behaviour when\n GetStringUTFChars fails while open FD\n \u002B Epoll: Add null checks for safety reasons\n \u002B Epoll: Use correct value to initialize mmsghdr.msg_namelen\n \u002B Epoll: Fix support for IP_RECVORIGDSTADDR\n \u002B AdaptivePoolingAllocator: remove ensureAccessible() call in\n capacity(int) method\n \u002B Epoll: setTcpMg5Sig(...) might overflow\n \u002B JdkZlibDecoder: accumulate decompressed output before firing\n channelRead\n \u002B Limit the number of Continuation frames per HTTP2 Headers\n (bsc#1261043, CVE-2026-33871)\n \u002B Stricter HTTP/1.1 chunk extension parsing (bsc#1261031,\n CVE-2026-33870)\n \u002B rediff\n- Upgrade to upstream version 4.1.131\n \u002B NioDatagramChannel.block(...) does not early return on failure\n \u002B Support for AWS Libcrypto (AWS-LC) netty-tcnative build\n \u002B codec-dns: Decompress MX RDATA exchange domain names during\n DNS record decoding\n \u002B Buddy allocation for large buffers in adaptive allocator\n \u002B SslHandler: Only resume on EventLoop if EventLoop is not\n shutting down already\n \u002B Wrap ECONNREFUSED in PortUnreachableException for UDP\n \u002B Bump com.ning:compress-lzf (4.1)\n \u002B Fix adaptive allocator bug from not noticing failed allocation\n \u002B Avoid loosing original read exception\n \u002B Backport multiple adaptive allocator changes\n- Upgrade to version 4.1.130\n- Upgrade to version 2.0.75 Final\n * No formal changelog present\n * Needed by netty \u003E= 4.2.11",
  "published": "2026-04-15T13:37:19Z",
  "severity": "",
  "epss": 0.00701,
  "epssPercentile": 0.53489,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "netty",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "4.1.132-150200.4.43.1",
      "fix": "SUSE-SU-2026:1353-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1353-1",
      "released": "2026-04-15T13:37:19Z"
    },
    {
      "platform": "linux",
      "product": "netty",
      "release": "sles 15.7",
      "fixedVersion": "4.1.132-150200.4.43.1",
      "fix": "SUSE-SU-2026:1353-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1353-1",
      "released": "2026-04-15T13:37:19Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.0.75-150200.3.36.1",
      "fix": "SUSE-SU-2026:1353-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1353-1",
      "released": "2026-04-15T13:37:19Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "sles 15.7",
      "fixedVersion": "2.0.75-150200.3.36.1",
      "fix": "SUSE-SU-2026:1353-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-1353-1",
      "released": "2026-04-15T13:37:19Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T07:50:38Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}