Tagged “ghsa”

CVEs tagged ghsa, newest first.

5758 CVEsRSS

CVE-2026-47244Medium· 5.3

netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams (CVE-2026-47244)

A flaw was found in Netty, a network application framework. A remote attacker can exploit this vulnerability by sending a large number of HTTP/2 stream requests to a Netty HTTP/2 server. If the server does not explicitly limit concurrent s…

▾ SunlitRed Hat · OpenShift ServerlessEPSS 0.38%via CSAF

CVE-2026-48006High· 7.5

5mo ago

Netty is a network application framework for development of protocol servers and clients

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipe…

Tagged “ghsa”

netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams (CVE-2026-47244)

Netty is a network application framework for development of protocol servers and clients

Go-Attestation: Hash injection into trusted measurement list via unskipped SignatureHeaderSize vendor bytes in parseEfiSignatureList()

Firefly II has Stored XSS in Audit Log Entry view via piggy bank name (ale.twig)

SwiftNIO: CRLF Injection in outbound HTTP request URI via NIOHTTPRequestHeadersValidator

SwiftNIO: Out-of-bounds write via ByteBuffer index and length UInt32 overflow

SwiftNIO NIOHTTP1: HTTPDecoder accepts unbounded HTTP/1 header blocks, enabling remote DoS

NIOExtras: NIOHTTPRequestDecompressor ratio limit bypass via inflated Content-Length

SwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec

Budibase: SSRF via User-Controlled queryId in Automation Execute Query Step

Budibase: SSRF via OAuth2 Config Validation — Missing fetchWithBlacklist Protection

Budibase: Unanchored Regex in `matchers.ts` Allows CSRF Bypass via Query String Injection in Budibase Worker

Budibase: Unvalidated VectorDB Host Parameter Enables SSRF

Appsmith Super User Creation Race Condition Allows Multiple Instance Administrators

Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign

Budibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema

Budibase: Basic app users can exfiltrate stored REST datasource auth by rewriting datasource base URL

Appsmith: Configuration-dependent origin validation bypass in password reset and email verification link generation

nebula-mesh: POST /api/v1/hosts/{id}/mobile-bundle response lacks Cache-Control: no-store

Tornado has out-of-bounds memory access via C extension

TYPO3 HTML Sanitizer allows Cross-site Scripting

TYPO3 CMS has Cross-Site Scripting in Indexed Search

TYPO3 CMS: Broken Access Control in Media Module

TYPO3 CMS has Broken Access Control in Backend API

TYPO3 CMS has Broken Access Control in its File Abstraction Layer

TYPO3 CMS has Insecure Deserialization via Core API

TYPO3 CMS has Broken Access Control in its Media Module

TYPO3 CMS has Broken Access Control in its Form Framework

TYPO3 CMS has Broken Access Control in its DataHandler

TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework