جزئیات آسیب‌پذیری
CVE-2026-44893
Red Hat OpenShift ServerlessRed Hat Build of KeycloakRed Hat Fuse 7Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat build of Apache Camel - HawtIO 4Red Hat build of Apache Camel 4 for Quarkus 3
Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length
CVSS 3.1
7.5بالا
شرح رسمی (انگلیسی)
Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length below 5, the subsequent readByte/readInt throws IndexOutOfBoundsException. HAProxyMessageDecoder only catches HAProxyProtocolException around this call, so the IOOBE propagates and the retained slice on the pooled cumulation buffer is never released. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Debezium 3 | همه | CVEProject cvelistV5 (CNA) |
| netty | netty | < 4.1.135.Final | CVEProject cvelistV5 (CNA) |
| netty | netty | >= 4.2.0.Final, < 4.2.15.Final | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۲۱- https://github.com/netty/netty/security/advisories/GHSA-cc37-9q2j-3hfv x_refsource_CONFIRM
- https://github.com/netty/netty/releases/tag/netty-4.1.135.Final x_refsource_MISC
- https://github.com/netty/netty/releases/tag/netty-4.2.15.Final x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2026-44893 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2488383 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44893.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53645 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48151 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53646 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66488 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26586 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41951 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50085 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65126 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26018 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26017 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34608 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۳/۲۲
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۲۷
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۰٫۶۱٪
احتمال بهره‌برداری در ۳۰ روز
۴۹٫۷٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-703Improper Check or Handling of Exceptional Conditions
- CWE-805Buffer Access with Incorrect Length Value