# CVE-2026-55833: eap8-activemq-artemis: Netty is a network application framework for development of protocol servers and clients CVE-2026-55833 is fixed in 43 products on 1 platform, first by SUSE-SU-2026:3482-1, released August 4, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-55833 - Priority: High - CVSS: 7.5 (important) - EPSS: 0.0067 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Jul 20, 2026 ## Description Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into much larger raw header data and causes compression-amplified CPU and allocation churn. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | eap8-activemq-artemis RHEL 10 | 2.40.0-8.redhat_00024.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-apache-cxf RHEL 10 | 4.1.7-1.SP1_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-artemis-wildfly-integration RHEL 10 | 2.0.5-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-bouncycastle RHEL 10 | 1.85.0-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-cryptacular RHEL 10 | 1.2.7-1.redhat_00002.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-eap-product-conf-parent RHEL 10 | 801.8.0-1.GA_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-hibernate RHEL 10 | 6.6.54-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-httpcomponents-asyncclient RHEL 10 | 4.1.5-5.redhat_00008.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-ironjacamar RHEL 10 | 3.0.22-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jackson-annotations RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jackson-core RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jackson-databind RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jackson-dataformats-text RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jackson-jaxrs-providers RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jackson-modules-base RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jackson-modules-java8 RHEL 10 | 2.18.9-1.redhat_00003.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jakarta-xml-bind-api RHEL 10 | 4.0.5-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jaxb RHEL 10 | 4.0.7-4.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jaxbintros RHEL 10 | 2.1.0-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jboss-logging RHEL 10 | 3.6.3-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jboss-remoting RHEL 10 | 5.0.31-1.SP2_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jbossws-api RHEL 10 | 3.1.0-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jbossws-common-tools RHEL 10 | 2.2.0-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jbossws-cxf RHEL 10 | 7.4.0-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jbossws-jaxws-undertow-httpspi RHEL 10 | 3.0.1-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jbossws-spi RHEL 10 | 5.1.0-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-jsf-impl RHEL 10 | 4.0.11-2.SP1_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-log4j RHEL 10 | 2.25.4-1.redhat_00003.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-neethi RHEL 10 | 3.2.2-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-netty RHEL 10 | 4.1.136-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-netty-transport-native-epoll RHEL 10 | 4.1.136-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-nimbus-jose-jwt RHEL 10 | 9.37.4-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-parsson RHEL 10 | 1.1.9-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-saaj-impl RHEL 10 | 3.0.6-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-slf4j RHEL 10 | 2.0.18-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-undertow RHEL 10 | 2.3.26-2.SP3_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-wildfly RHEL 10 | 8.1.8-9.GA_redhat_00006.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-wildfly-elytron RHEL 10 | 2.6.11-1.Final_redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-wildfly-javadocs RHEL 10 | 8.1.1-12.GA_redhat_00048.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-ws-commons-XmlSchema RHEL 10 | 2.3.2-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | eap8-xml-security RHEL 10 | 3.0.6-1.redhat_00001.1.el10eap | [RHSA-2026:70230](https://patchblox.com/security/data/fix/linux/rhsa-2026-70230.md) | Sep 23, 2026 | | Linux | netty sles 15.7 | 4.1.136-150200.4.53.1 | [SUSE-SU-2026:3482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3482-1.md) | Aug 4, 2026 | | Linux | netty-tcnative sles 15.6 | 2.0.80-150200.3.48.1 | [SUSE-SU-2026:3482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3482-1.md) | Aug 4, 2026 | | Linux | netty-tcnative sles 15.7 | 2.0.80-150200.3.48.1 | [SUSE-SU-2026:3482-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-3482-1.md) | Aug 4, 2026 | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.