{
  "cveId": "CVE-2026-59898",
  "url": "https://patchblox.com/security/cve/CVE-2026-59898",
  "summary": "CVE-2026-59898 is fixed in 2 products on 1 platform, first by SUSE-SU-2026:3482-1, released August 4, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "netty-tcnative: This update for netty, netty-tcnative fixes the following issues:\n\nUpgrade netty to upstream version 4.1.136 and nett...",
  "description": "This update for netty, netty-tcnative fixes the following issues:\n\nUpgrade netty to upstream version 4.1.136 and netty-tcnative to version 2.0.80 Final.\n\nSecurity issues fixed\n\n- CVE-2026-44891: memory exhaustion in \u0060io.netty:netty-codec-stomp\u0060 (bsc#1271435).\n- CVE-2026-55831: resource exhaustion/DoS in \u0060io.netty:netty-codec-http\u0060 (bsc#1271960).\n- CVE-2026-55833: zip bomb in \u0060io.netty:netty-codec-http\u0060 (bsc#1271961).\n- CVE-2026-55851: memory exhaustion in \u0060io.netty:netty-codec-haproxy\u0060 (bsc#1272253).\n- CVE-2026-56745: memory exhaustion in \u0060io.netty:netty-codec-http\u0060 (bsc#1272254).\n- CVE-2026-56746: improper access control in \u0060io.netty:netty-codec-http\u0060 (CORS) (bsc#1272255).\n- CVE-2026-56817: insecure defaults in XML parsing in \u0060io.netty:netty-codec-xml\u0060 (bsc#1272257).\n- CVE-2026-56818: memory leak in \u0060io.netty:netty-codec-redis\u0060 (bsc#1272603).\n- CVE-2026-56819: memory leak in \u0060io.netty:netty-codec-http2\u0060 (bsc#1272258).\n- CVE-2026-56820: improper certificate validation in \u0060io.netty:netty-handler-ssl-ocsp\u0060 (bsc#1272259).\n- CVE-2026-56821: improper certificate revocation check in \u0060io.netty:netty-handler-ssl-ocsp\u0060 (bsc#1272299).\n- CVE-2026-56822: time-of-check/time-of-use in \u0060io.netty:netty-handler-ssl-ocsp\u0060 (bsc#1272300).\n- CVE-2026-59898: protocol version confusion in \u0060io.netty:netty-codec-http\u0060 (websocket) (bsc#1272302).\n- CVE-2026-59899: memory exhaustion in \u0060io.netty:netty-codec-http\u0060 (bsc#1272301).\n- CVE-2026-59900: improper header neutralization in \u0060io.netty:netty-codec-http2\u0060 (bsc#1272303).\n- CVE-2026-59901: infinite loop in \u0060io.netty:netty-codec-compression\u0060 (bzip2) (bsc#1272304).\n- CVE-2026-59919: improper CR/LF neutralization in \u0060io.netty:netty-codec-haproxy\u0060 (bsc#1272305).\n- CVE-2026-59920: improper CR/LF neutrolization in \u0060io.netty:netty-codec-stomp\u0060 (bsc#1272306).\n- CVE-2026-59921: improper CR/LF neutralization in \u0060io.netty:netty-codec-http\u0060 (multipart) (bsc#1272307).\n- Memory leak in \u0060io.netty:netty-codec-dns\u0060  (bsc#1272519).\n- Uncontrolled resource consumption in \u0060io.netty:netty-codec-xml\u0060 (bsc#1272518).\n\nOther updates and bugfixes:\n\n- Upgrade to upstream version 4.1.136:\n  \u002B SingleThreadEventExecutor: document Throwable safety contract\n    on run()\n  \u002B Make HTTP/2 frame hashCode consistent with equals\n  \u002B Add BlockHound exception for DnsQueryIdSpace (#16896)\n  \u002B FlowControlHandler: Fix autoRead behavior\n  \u002B Fix incorrect bounds in error message of\n    HpackDecoder.setMaxHeaderListSize\n  \u002B MQTT: Fix MQTT decoder size check after variable header replay\n  \u002B MQTT: Make the decodeProperties early-REPLAY check actually\n    fire\n  \u002B Reject control characters at the boundary of HTTP method names\n    (#16723)\n  \u002B Update to latest tcnative release\n  \u002B Fix HTTP 2 PUSH_PROMISE stream association validation\n  \u002B Fix GZIP FEXTRA extra-field handling in JdkZlibDecoder\n  \u002B Add opt-in validation of mandatory pseudo-header fields for\n    HTTP/2\n  \u002B Strictly validate MQTT UTF-8 Encoded String (#16939)\n  \u002B Stop DateFormatter trailing token from running past the parse\n    end\n  \u002B IpFilter: Deprecate constructor which use accept by default\n  \u002B Add RFC 10008 QUERY Method support (#16966)\n  \u002B Correctly release and fail queued traffic-shaping writes on\n    close (#16959)\n  \u002B FlowControlHandler: respect auto-read when toggled while\n    dequeueing\n  \u002B IdleStateHandler: reset firstWriter/ReaderIdleEvent in\n    resetWriteTimeout/resetReadTimeout (#16982)\n  \u002B Fix typo in AbstractSniHandler Javadoc\n  \u002B Reconcile AbstractCoalescingBufferQueue readableBytes when it\n    drains, and fail stuck HTTP/2 streams instead of spinning\n    empty DATA frames\n  \u002B Reject control characters at the boundary of the HTTP version\n    token (#16971)\n  \u002B Reset UTF-8 decode state on CR in StompSubframeDecoder\n  \u002B HTTP2: Pass the correct number of arguments when logging\n    goaway\n  \u002B FastLz: Guard decompression against truncated input (#17000)\n  \u002B Fix propagation of startTls for client SslContext handler\n  \u002B Reject non-token characters in HTTP/2 header names\n  \u002B Update lz4-java to 1.11.1\n  \u002B Pin github actions to reduce risk (#17043)\n  \u002B Merge branches from forks (#17063)",
  "published": "2026-08-04T11:46:42Z",
  "severity": "",
  "epss": 0.00439,
  "epssPercentile": 0.38434,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "netty",
      "release": "sles 15.7",
      "fixedVersion": "4.1.136-150200.4.53.1",
      "fix": "SUSE-SU-2026:3482-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3482-1",
      "released": "2026-08-04T11:46:42Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "sles 15.6",
      "fixedVersion": "2.0.80-150200.3.48.1",
      "fix": "SUSE-SU-2026:3482-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3482-1",
      "released": "2026-08-04T11:46:42Z"
    },
    {
      "platform": "linux",
      "product": "netty-tcnative",
      "release": "sles 15.7",
      "fixedVersion": "2.0.80-150200.3.48.1",
      "fix": "SUSE-SU-2026:3482-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-3482-1",
      "released": "2026-08-04T11:46:42Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-10T13:56:55Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}