# CVE-2026-93569: netty-tcnative: This update for netty, netty-tcnative fixes the following issues:  - CVE-2026-59902: Netty: Memory Exhaustion in Sctp...

CVE-2026-93569 is fixed in 2 products on 1 platform, first by SUSE-SU-2026:4391-1, released September 29, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-93569
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0242
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 29, 2026

## Description

This update for netty, netty-tcnative fixes the following issues:  - CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501). - CVE-2026-59903: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite   (bsc#1275500). - CVE-2026-62243: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455). - CVE-2026-62380: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456). - CVE-2026-75595: fragmented TLS `ClientHello` causes fallback to default `SslContext` and allows for SNI routing and   mTLS requirement bypass (bsc#1276420). - CVE-2026-75596: fragmented `ClientHello`records can trigger quadratic pre-handshake reassembly in default SNI parsing   (bsc#1276421). - CVE-2026-76816: missing input validation in `MqttEncoder` allows for null-byte injection, topic hijacking, and ACL   bypassing (bsc#1277243). - CVE-2026-89044: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding   (bsc#1280048). - CVE-2026-93488: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084). - CVE-2026-93491: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085). - CVE-2026-93492: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132). - CVE-2026-93493: missing `nextUpdate` field in OCSP responses leads to silent validation bypass (bsc#1281431). - CVE-2026-93494: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506). - CVE-2026-93558: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service   (bsc#1282140). - CVE-2026-93560: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141). - CVE-2026-93562: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362). - CVE-2026-93563: unbounded multi-line response accumulation in `SmtpResponseDecoder` leads to memory exhaustion and a   DoS (bsc#1281432). - CVE-2026-93564: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363). - CVE-2026-93565: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364). - CVE-2026-93566: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366). - CVE-2026-93567: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled   :authority (bsc#1282367). - CVE-2026-93568: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370). - CVE-2026-93569: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target   authority (bsc#1282372). - CVE-2026-93572: multiplication of patched preallocation limits in `RedisArrayAggregator` nested RESP headers can lead   to denial of service (bsc#1281433). - CVE-2026-93573: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373). - CVE-2026-93574: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374). - CVE-2026-93575: missing validations in the `MqttDecoder` can lead to excessive resource consumption and a DoS   (bsc#1281434). - CVE-2026-93576: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507). - CVE-2026-93578: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass   (bsc#1281435). - CVE-2026-93579: HTTP/2 header field values are not validated by default (bsc#1282378).  Changes for netty:  - Upgrade to upstream version 4.1.138  Changes for netty-tcnative:  - Upgrade to version 2.0.84 Final

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | netty sles 15.7 | 4.1.138-150200.4.56.1 | [SUSE-SU-2026:4391-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4391-1.md) | Sep 29, 2026 |
| Linux | netty-tcnative sles 15.6 | 2.0.84-150200.3.51.1 | [SUSE-SU-2026:4391-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4391-1.md) | Sep 29, 2026 |
| Linux | netty-tcnative sles 15.7 | 2.0.84-150200.3.51.1 | [SUSE-SU-2026:4391-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4391-1.md) | Sep 29, 2026 |

---

Data as of 2026-11-10T13:56:55Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.