Vulnerable Library - spring-boot-starter-data-redis-reactive-3.1.12.jar
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Vulnerabilities
| Vulnerability |
Severity |
 CVSS |
Dependency |
Type |
Fixed in (spring-boot-starter-data-redis-reactive version) |
Remediation Possible** |
| CVE-2026-75595 |
 Critical |
9.1 |
netty-handler-4.1.110.Final.jar |
Transitive |
4.1.0 |
❌ |
| CVE-2026-44249 |
 High |
8.1 |
netty-handler-4.1.110.Final.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-75596 |
High |
7.5 |
netty-handler-4.1.110.Final.jar |
Transitive |
4.1.0 |
❌ |
| CVE-2026-62243 |
High |
7.5 |
netty-handler-4.1.110.Final.jar |
Transitive |
4.1.0 |
❌ |
| CVE-2026-59901 |
High |
7.5 |
netty-codec-4.1.110.Final.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-50010 |
High |
7.5 |
netty-handler-4.1.110.Final.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-45416 |
High |
7.5 |
netty-handler-4.1.110.Final.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-42583 |
High |
7.5 |
netty-codec-4.1.110.Final.jar |
Transitive |
3.2.2 |
❌ |
| CVE-2025-24970 |
High |
7.5 |
netty-handler-4.1.110.Final.jar |
Transitive |
3.2.0 |
❌ |
| CVE-2026-41719 |
 Medium |
6.4 |
detected in multiple dependencies |
Transitive |
N/A* |
❌ |
| CVE-2026-47863 |
Medium |
5.9 |
reactor-core-3.5.17.jar |
Transitive |
N/A* |
❌ |
| CVE-2026-47857 |
Medium |
5.9 |
reactor-core-3.5.17.jar |
Transitive |
N/A* |
❌ |
| CVE-2025-25193 |
Medium |
5.5 |
netty-common-4.1.110.Final.jar |
Transitive |
3.2.0 |
❌ |
| CVE-2024-47535 |
Medium |
5.5 |
netty-common-4.1.110.Final.jar |
Transitive |
N/A* |
❌ |
| CVE-2025-58057 |
Medium |
5.3 |
netty-codec-4.1.110.Final.jar |
Transitive |
3.2.2 |
❌ |
| CVE-2026-59280 |
Medium |
4.3 |
spring-context-support-6.0.21.jar |
Transitive |
N/A* |
❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-75595
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ netty-handler-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Publish Date: 2026-08-19
URL: CVE-2026-75595
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-c4c3-7fpv-j4q5
Release Date: 2026-08-19
Fix Resolution (io.netty:netty-handler): 4.1.137.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 4.1.0
Step up your Open Source Security Game with Mend here
CVE-2026-44249
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ netty-handler-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Publish Date: 2026-06-11
URL: CVE-2026-44249
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-08
Fix Resolution: https://github.com/netty/netty.git - netty-4.2.15.Final,https://github.com/netty/netty.git - netty-4.1.135.Final
Step up your Open Source Security Game with Mend here
CVE-2026-75596
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ netty-handler-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Publish Date: 2026-08-19
URL: CVE-2026-75596
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-fccg-mwvh-qqg4
Release Date: 2026-08-19
Fix Resolution (io.netty:netty-handler): 4.1.137.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 4.1.0
Step up your Open Source Security Game with Mend here
CVE-2026-62243
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ netty-handler-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.
Publish Date: 2026-08-22
URL: CVE-2026-62243
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-p85m-gvr3-788c
Release Date: 2026-08-22
Fix Resolution (io.netty:netty-handler): 4.1.137.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 4.1.0
Step up your Open Source Security Game with Mend here
CVE-2026-59901
Vulnerable Library - netty-codec-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.110.Final/netty-codec-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- netty-handler-4.1.110.Final.jar
- ❌ netty-codec-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the "Bzip2Decoder" handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within ["Bzip2BlockDecompressor.read()"]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Publish Date: 2026-07-29
URL: CVE-2026-59901
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-558v-64gr-wgg4
Release Date: 2026-07-22
Fix Resolution: io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final
Step up your Open Source Security Game with Mend here
CVE-2026-50010
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ netty-handler-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with "SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)" performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Publish Date: 2026-06-12
URL: CVE-2026-50010
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-12
Fix Resolution: https://github.com/netty/netty.git - 4.1.135.Final
Step up your Open Source Security Game with Mend here
CVE-2026-45416
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ netty-handler-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates "ctx.alloc().buffer(handshakeLength)" (line 161). The guard at line 140 is "handshakeLength > maxClientHelloLength && maxClientHelloLength != 0", and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Publish Date: 2026-06-12
URL: CVE-2026-45416
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-09
Fix Resolution: https://github.com/netty/netty.git - netty-4.2.15.Final,https://github.com/netty/netty.git - netty-4.1.135.Final
Step up your Open Source Security Game with Mend here
CVE-2026-42583
Vulnerable Library - netty-codec-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.110.Final/netty-codec-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- netty-handler-4.1.110.Final.jar
- ❌ netty-codec-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Publish Date: 2026-05-13
URL: CVE-2026-42583
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-05-08
Fix Resolution (io.netty:netty-codec): 4.1.133.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 3.2.2
Step up your Open Source Security Game with Mend here
CVE-2025-24970
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ netty-handler-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
Publish Date: 2025-02-10
URL: CVE-2025-24970
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-4g8c-wm8x-jfhw
Release Date: 2025-02-10
Fix Resolution (io.netty:netty-handler): 4.1.118.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 3.2.0
Step up your Open Source Security Game with Mend here
CVE-2026-41719
Vulnerable Libraries - spring-data-redis-3.1.12.jar, spring-data-keyvalue-3.1.12.jar
spring-data-redis-3.1.12.jar
Spring Data module for Redis
Library home page: https://www.spring.io
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/data/spring-data-redis/3.1.12/spring-data-redis-3.1.12.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- ❌ spring-data-redis-3.1.12.jar (Vulnerable Library)
spring-data-keyvalue-3.1.12.jar
Library home page: https://www.spring.io/spring-data
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/data/spring-data-keyvalue/3.1.12/spring-data-keyvalue-3.1.12.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- spring-data-redis-3.1.12.jar
- ❌ spring-data-keyvalue-3.1.12.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.
Affected versions:
Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
Publish Date: 2026-06-09
URL: CVE-2026-41719
CVSS 3 Score Details (6.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41719
Release Date: 2026-06-09
Fix Resolution: org.springframework.data:spring-data-keyvalue:3.4.15,org.springframework.data:spring-data-keyvalue:4.0.6,org.springframework.data:spring-data-redis:3.5.12,org.springframework.data:spring-data-redis:3.4.15,org.springframework.data:spring-data-redis:2.7.20,org.springframework.data:spring-data-redis:4.0.6,org.springframework.data:spring-data-redis:3.3.17,org.springframework.data:spring-data-keyvalue:3.3.17,org.springframework.data:spring-data-keyvalue:2.7.20,org.springframework.data:spring-data-keyvalue:3.5.12,https://github.com/spring-projects/spring-data-keyvalue.git - 4.0.6
Step up your Open Source Security Game with Mend here
CVE-2026-47863
Vulnerable Library - reactor-core-3.5.17.jar
Non-Blocking Reactive Foundation for the JVM
Library home page: https://github.com/reactor/reactor-core
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/projectreactor/reactor-core/3.5.17/reactor-core-3.5.17.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ reactor-core-3.5.17.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.
Reactor Core 3.8.0 - 3.8.6
Reactor Core 3.7.19 and earlier
Publish Date: 2026-08-26
URL: CVE-2026-47863
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-26
Fix Resolution: https://github.com/reactor/reactor-core.git - v3.8.7,io.projectreactor:reactor-core:3.8.7
Step up your Open Source Security Game with Mend here
CVE-2026-47857
Vulnerable Library - reactor-core-3.5.17.jar
Non-Blocking Reactive Foundation for the JVM
Library home page: https://github.com/reactor/reactor-core
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/projectreactor/reactor-core/3.5.17/reactor-core-3.5.17.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ reactor-core-3.5.17.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.
Reactor Core 3.8.0 - 3.8.6
Reactor Core 3.5.0 - 3.7.19
Reactor Core 3.4.41 and earlier
Publish Date: 2026-08-26
URL: CVE-2026-47857
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-08-26
Fix Resolution: https://github.com/reactor/reactor-core.git - v3.8.7,io.projectreactor:reactor-core:3.8.7
Step up your Open Source Security Game with Mend here
CVE-2025-25193
Vulnerable Library - netty-common-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-common/4.1.110.Final/netty-common-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ netty-common-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
Publish Date: 2025-02-10
URL: CVE-2025-25193
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-389x-839f-4rhx
Release Date: 2025-02-10
Fix Resolution (io.netty:netty-common): 4.1.118.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 3.2.0
Step up your Open Source Security Game with Mend here
CVE-2024-47535
Vulnerable Library - netty-common-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-common/4.1.110.Final/netty-common-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- ❌ netty-common-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
Publish Date: 2024-11-12
URL: CVE-2024-47535
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-xq3w-v528-46rv
Release Date: 2024-11-12
Fix Resolution: io.netty:netty-common:4.1.115.Final
Step up your Open Source Security Game with Mend here
CVE-2025-58057
Vulnerable Library - netty-codec-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.110.Final/netty-codec-4.1.110.Final.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- lettuce-core-6.2.7.RELEASE.jar
- netty-handler-4.1.110.Final.jar
- ❌ netty-codec-4.1.110.Final.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-09-03
URL: CVE-2025-58057
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2025-09-03
Fix Resolution (io.netty:netty-codec): 4.1.125.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 3.2.2
Step up your Open Source Security Game with Mend here
CVE-2026-59280
Vulnerable Library - spring-context-support-6.0.21.jar
Spring Context Support
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-context-support/6.0.21/spring-context-support-6.0.21.jar
Dependency Hierarchy:
- spring-boot-starter-data-redis-reactive-3.1.12.jar (Root Library)
- spring-boot-starter-data-redis-3.1.12.jar
- spring-data-redis-3.1.12.jar
- ❌ spring-context-support-6.0.21.jar (Vulnerable Library)
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-59280
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-59280
Release Date: 2026-08-27
Fix Resolution: org.springframework:spring-context-support:7.0.9,https://github.com/spring-projects/spring-framework.git - v7.0.9
Step up your Open Source Security Game with Mend here
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instead of the SNI-specific context. In deployments where per-SNI clientAuth=REQUIRE is the sole mutual TLS gate, the default SslContext uses clientAuth=NONE or clientAuth=OPTIONAL, and no application-layer certificate verification exists, an unauthenticated remote attacker can bypass the protected route's mutual TLS requirement. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Publish Date: 2026-08-19
URL: CVE-2026-75595
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-c4c3-7fpv-j4q5
Release Date: 2026-08-19
Fix Resolution (io.netty:netty-handler): 4.1.137.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 4.1.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Publish Date: 2026-06-11
URL: CVE-2026-44249
CVSS 3 Score Details (8.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-08
Fix Resolution: https://github.com/netty/netty.git - netty-4.2.15.Final,https://github.com/netty/netty.git - netty-4.1.135.Final
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer can advertise a large ClientHello and deliver its body in thousands of tiny records, causing quadratic CPU work on the event loop before the TLS handshake completes and degrading TLS handling for other clients. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final.
Publish Date: 2026-08-19
URL: CVE-2026-75596
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-fccg-mwvh-qqg4
Release Date: 2026-08-19
Fix Resolution (io.netty:netty-handler): 4.1.137.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 4.1.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted without validation. Fixed in 4.2.17.Final and 4.1.137.Final.
Publish Date: 2026-08-22
URL: CVE-2026-62243
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-p85m-gvr3-788c
Release Date: 2026-08-22
Fix Resolution (io.netty:netty-handler): 4.1.137.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 4.1.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-codec-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.110.Final/netty-codec-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the "Bzip2Decoder" handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within ["Bzip2BlockDecompressor.read()"]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Publish Date: 2026-07-29
URL: CVE-2026-59901
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-558v-64gr-wgg4
Release Date: 2026-07-22
Fix Resolution: io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with "SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)" performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Publish Date: 2026-06-12
URL: CVE-2026-50010
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-12
Fix Resolution: https://github.com/netty/netty.git - 4.1.135.Final
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates "ctx.alloc().buffer(handshakeLength)" (line 161). The guard at line 140 is "handshakeLength > maxClientHelloLength && maxClientHelloLength != 0", and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
Publish Date: 2026-06-12
URL: CVE-2026-45416
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-09
Fix Resolution: https://github.com/netty/netty.git - netty-4.2.15.Final,https://github.com/netty/netty.git - netty-4.1.135.Final
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-codec-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.110.Final/netty-codec-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Publish Date: 2026-05-13
URL: CVE-2026-42583
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-05-08
Fix Resolution (io.netty:netty-codec): 4.1.133.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 3.2.2
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-handler-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-handler/4.1.110.Final/netty-handler-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
Publish Date: 2025-02-10
URL: CVE-2025-24970
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-4g8c-wm8x-jfhw
Release Date: 2025-02-10
Fix Resolution (io.netty:netty-handler): 4.1.118.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 3.2.0
Step up your Open Source Security Game with Mend here
Vulnerable Libraries - spring-data-redis-3.1.12.jar, spring-data-keyvalue-3.1.12.jar
spring-data-redis-3.1.12.jar
Spring Data module for Redis
Library home page: https://www.spring.io
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/data/spring-data-redis/3.1.12/spring-data-redis-3.1.12.jar
Dependency Hierarchy:
spring-data-keyvalue-3.1.12.jar
Library home page: https://www.spring.io/spring-data
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/data/spring-data-keyvalue/3.1.12/spring-data-keyvalue-3.1.12.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates evaluation to the SpelPropertyComparator.
Affected versions:
Spring Data KeyValue / Spring Data Redis 4.0.0 through 4.0.5; 3.5.0 through 3.5.11; 3.4.0 through 3.4.14; 3.3.0 through 3.3.16; 3.2.0 through 3.2.15; 3.1.0 through 3.1.14; 3.0.0 through 3.0.15; 2.7.0 through 2.7.19.
Publish Date: 2026-06-09
URL: CVE-2026-41719
CVSS 3 Score Details (6.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-41719
Release Date: 2026-06-09
Fix Resolution: org.springframework.data:spring-data-keyvalue:3.4.15,org.springframework.data:spring-data-keyvalue:4.0.6,org.springframework.data:spring-data-redis:3.5.12,org.springframework.data:spring-data-redis:3.4.15,org.springframework.data:spring-data-redis:2.7.20,org.springframework.data:spring-data-redis:4.0.6,org.springframework.data:spring-data-redis:3.3.17,org.springframework.data:spring-data-keyvalue:3.3.17,org.springframework.data:spring-data-keyvalue:2.7.20,org.springframework.data:spring-data-keyvalue:3.5.12,https://github.com/spring-projects/spring-data-keyvalue.git - 4.0.6
Step up your Open Source Security Game with Mend here
Vulnerable Library - reactor-core-3.5.17.jar
Non-Blocking Reactive Foundation for the JVM
Library home page: https://github.com/reactor/reactor-core
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/projectreactor/reactor-core/3.5.17/reactor-core-3.5.17.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.
Reactor Core 3.8.0 - 3.8.6
Reactor Core 3.7.19 and earlier
Publish Date: 2026-08-26
URL: CVE-2026-47863
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-26
Fix Resolution: https://github.com/reactor/reactor-core.git - v3.8.7,io.projectreactor:reactor-core:3.8.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - reactor-core-3.5.17.jar
Non-Blocking Reactive Foundation for the JVM
Library home page: https://github.com/reactor/reactor-core
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/projectreactor/reactor-core/3.5.17/reactor-core-3.5.17.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.
Reactor Core 3.8.0 - 3.8.6
Reactor Core 3.5.0 - 3.7.19
Reactor Core 3.4.41 and earlier
Publish Date: 2026-08-26
URL: CVE-2026-47857
CVSS 3 Score Details (5.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-08-26
Fix Resolution: https://github.com/reactor/reactor-core.git - v3.8.7,io.projectreactor:reactor-core:3.8.7
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-common-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-common/4.1.110.Final/netty-common-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crash. A similar issue was previously reported as CVE-2024-47535. This issue was fixed, but the fix was incomplete in that null-bytes were not counted against the input limit. Commit d1fbda62d3a47835d3fb35db8bd42ecc205a5386 contains an updated fix.
Publish Date: 2025-02-10
URL: CVE-2025-25193
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-389x-839f-4rhx
Release Date: 2025-02-10
Fix Resolution (io.netty:netty-common): 4.1.118.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 3.2.0
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-common-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-common/4.1.110.Final/netty-common-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load a file that does not exist. If an attacker creates such a large file, the Netty application crashes. This vulnerability is fixed in 4.1.115.
Publish Date: 2024-11-12
URL: CVE-2024-47535
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: GHSA-xq3w-v528-46rv
Release Date: 2024-11-12
Fix Resolution: io.netty:netty-common:4.1.115.Final
Step up your Open Source Security Game with Mend here
Vulnerable Library - netty-codec-4.1.110.Final.jar
Library home page: https://netty.io/
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/io/netty/netty-codec/4.1.110.Final/netty-codec-4.1.110.Final.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: 2025-09-03
URL: CVE-2025-58057
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2025-09-03
Fix Resolution (io.netty:netty-codec): 4.1.125.Final
Direct dependency fix Resolution (org.springframework.boot:spring-boot-starter-data-redis-reactive): 3.2.2
Step up your Open Source Security Game with Mend here
Vulnerable Library - spring-context-support-6.0.21.jar
Spring Context Support
Library home page: https://github.com/spring-projects/spring-framework
Sample Path to Dependency File: /pom.xml
Path to vulnerable library: /home/wss-scanner/.m2/repository/org/springframework/spring-context-support/6.0.21/spring-context-support-6.0.21.jar
Dependency Hierarchy:
Found in HEAD commit: 985d4a71b0cc06b07e4e37fda7739bbfc0dfc733
Found in base branch: master
Vulnerability Details
Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through SpringTemplateLoader.
Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19
Spring Framework 6.1.0 - 6.1.28
Spring Framework 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49
Spring Framework 5.2.25.RELEASE and earlier
Publish Date: 2026-08-27
URL: CVE-2026-59280
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://spring.io/security/cve-2026-59280
Release Date: 2026-08-27
Fix Resolution: org.springframework:spring-context-support:7.0.9,https://github.com/spring-projects/spring-framework.git - v7.0.9
Step up your Open Source Security Game with Mend here