{
  "cveId": "CVE-2026-46340",
  "url": "https://patchblox.com/security/cve/CVE-2026-46340",
  "summary": "CVE-2026-46340 is fixed in 2 products on 1 platform, first by SUSE-SU-2026:2802-1, released July 8, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "netty-tcnative: This update for netty, netty-tcnative fixes the following issue\n\nThis update for netty, netty-tcnative fixes the foll...",
  "description": "This update for netty, netty-tcnative fixes the following issue\n\nThis update for netty, netty-tcnative fixes the following issues\n\nUpgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:\n\n- CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).\n- CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).\n- CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).\n- CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).\n- CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).\n- CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).\n- CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).\n- CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).\n- CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage fragments\n  (bsc#1268250).\n- CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).\n- CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).\n- CVE-2026-48006: netty-codec-redis: Netty\u0027s Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in\n  RedisArrayAggregator (bsc#1268255).\n- CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).\n- CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol headers\n  (bsc#1268258).\n- CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).\n- CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).\n- CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are\n  permitted (bsc#1268261).\n- CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (bsc#1268262).\n\nChanges:\n\n \u002B MQTT: Allow MQTT 5 CONNECT with password only\n \u002B ChannelInitializer: correct misleading comment on\n exceptionCaught route\n \u002B HTTP/2: Parse request-target path like Vert.x (4.1 backport)\n \u002B HttpObjectDecoder skips arbitrary initial control characters\n when only initial CRLF characters are permitted\n \u002B IpSubnetFilter: Correctly handle ipv6\n \u002B Configurable bound on RedisArrayAggregator\n \u002B Redis: Limit decoded length\n \u002B DNS: Ensure query id is not predictible\n \u002B Wrapping plain trust manager silently disables hostname\n verification\n \u002B MQTT: Reject malformed no-payload packets with non-zero\n Remaining Length\n \u002B HAProxy: Reject HAProxyMessages with malformated TLV and not\n leak memory\n \u002B SSL: Use sane defaults as limits for the client hello length\n and timeout\n \u002B DNS: Only cache CNAME if part of the queried domain\n \u002B HTTP/2: Enforce max concurrent streams for misbehaving clients\n \u002B Dns: Insufficient Bailiwick Validation for NS Records\n \u002B HTTP2: DelegatingDecompressorFrameListener must release memory\n in all cases\n \u002B Pass maxAllocation to Brotli and Zstd decoders\n \u002B HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory\n \u002B Add maxWindowLog parameter to ZstdDecoder to bound memory\n allocation\n \u002B HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs\n \u002B Epoll / Kqueue: Correctly handle receive of FD\n \u002B SCTP: Limit the number of inflight incomplete SCTP messages\n and the number of fragments\n \u002B Redis: Correctly release incomplete message on removal when\n using RedisArrayAggregator\n \u002B Redis: Limit the maximum number of nested arrays\n \u002B HTTP: Re-add constructor to HttpProxyHandler that was removed\n by mistake\n \u002B Marshalling: Explicit document security requirements\n \u002B Pin HTTP/RTSP version \u002B method normalization to Locale.US\n \u002B Adaptive: Fix concurrency issue in adaptive allocator\n \u002B Pin multipart Content-Type / Content-Transfer-Encoding case\n folding to Locale.US\n \u002B Remove dead native declarations\n \u002B Avoid re-parsing openssl key material with non-cached provider\n \u002B IpFilter: Fix ClassCastException caused by IpSubnetFilter if\n only ipv6 rules are configured but remote peer is using ipv4\n \u002B Resolve all localhost addresses without querying DNS servers\n \u002B HTTP2: Use 100 as default max concurrent streams setting\n \u002B Route synchronous onLookupComplete exceptions via\n fireExceptionCaught\n \u002B Fix MQTT decoder size check after variable header replay",
  "published": "2026-07-08T19:06:43Z",
  "severity": "",
  "epss": 0.00606,
  "epssPercentile": 0.49253,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "netty",
      "release": "sles 15.7",
      "fixedVersion": "4.1.135-150200.4.50.1",
      "fix": "SUSE-SU-2026:2802-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2802-1",
      "released": "2026-07-08T19:06:43Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "sles 15.6",
      "fixedVersion": "2.0.79-150200.3.45.1",
      "fix": "SUSE-SU-2026:2802-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2802-1",
      "released": "2026-07-08T19:06:43Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "sles 15.7",
      "fixedVersion": "2.0.79-150200.3.45.1",
      "fix": "SUSE-SU-2026:2802-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-2802-1",
      "released": "2026-07-08T19:06:43Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}