Veille CVE
CVE-2026-44249
8.1 ÉlevéeDescription
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Produits concernés
- netty
- Red Hat Cryostat 4 on RHEL 9
- Red Hat AMQ Broker 7.13.6
- Red Hat AMQ Broker 7.14.1
- Red Hat Build of Apache Camel 3.33 for Quarkus 3.33.2.SP1
- Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
- Red Hat build of Quarkus 3.27.4.SP1
- Red Hat build of Quarkus 3.33.2.SP1
- Red Hat Data Grid 8.6.2
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
- Red Hat JBoss Enterprise Application Platform 8.1
- Red Hat JBoss Enterprise Application Platform 8.1.7.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
- Red Hat Streams for Apache Kafka 2.9.4
- Red Hat Streams for Apache Kafka 3.2.1
- Red Hat Offline Knowledge Portal 1.2.12
- Red Hat OpenShift AI 2.25
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat OpenShift Serverless
- Red Hat AMQ Clients
- Red Hat build of Apache Camel 4 for Quarkus 3
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.1 Élevée | security-advisories@github.com | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 8.1 Élevée | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final Release Notes
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final Release Notes
- https://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:26017
- https://access.redhat.com/errata/RHSA-2026:26018
- https://access.redhat.com/errata/RHSA-2026:26586
- https://access.redhat.com/errata/RHSA-2026:28573
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/errata/RHSA-2026:37390
- https://access.redhat.com/errata/RHSA-2026:41951
- https://access.redhat.com/errata/RHSA-2026:48124
- https://access.redhat.com/errata/RHSA-2026:48151
- https://access.redhat.com/errata/RHSA-2026:49700
- https://access.redhat.com/errata/RHSA-2026:49701
- https://access.redhat.com/errata/RHSA-2026:50085
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:54435
- https://access.redhat.com/errata/RHSA-2026:65126
- https://access.redhat.com/errata/RHSA-2026:66488
- https://access.redhat.com/errata/RHSA-2026:66545
- https://access.redhat.com/security/cve/CVE-2026-44249
- https://bugzilla.redhat.com/show_bug.cgi?id=2488081
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json