Known vulnerabilities in Red Hat AMQ Clients

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-93562	Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling	6.5 Medium	Sep 18, 2026
CVE-2026-93574	Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing	6.5 Medium	Sep 18, 2026
CVE-2026-93573	Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling	6.5 Medium	Sep 18, 2026
CVE-2026-93566	Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line	6.5 Medium	Sep 18, 2026
CVE-2026-93565	Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte	7.5 High	Sep 18, 2026
CVE-2026-93558	Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service	7.5 High	Sep 18, 2026
CVE-2026-93491	Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue	7.5 High	Sep 18, 2026
CVE-2026-93488	Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams	7.5 High	Sep 18, 2026
CVE-2026-57915	It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized…	Not rated	Jun 26, 2026
CVE-2026-54513	jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor	8.1 High	Jun 23, 2026
CVE-2026-50010	Netty is a network application framework for development of protocol servers and clients	7.5 High	Jun 12, 2026
CVE-2026-45416	Netty is a network application framework for development of protocol servers and clients	7.5 High	Jun 12, 2026
CVE-2026-44249	Netty is a network application framework for development of protocol servers and clients	8.1 High	Jun 11, 2026
CVE-2026-40984	In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service…	7.5 High	Jun 9, 2026
CVE-2026-40983	In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service…	7.5 High	Jun 9, 2026
CVE-2026-42587	Netty is an asynchronous, event-driven network application framework	7.5 High	May 13, 2026
CVE-2026-42584	Netty is an asynchronous, event-driven network application framework	7.3 High	May 13, 2026
CVE-2026-42578	Netty is an asynchronous, event-driven network application framework	2.9 Low	May 13, 2026
CVE-2026-42581	Netty is an asynchronous, event-driven network application framework	5.8 Medium	May 13, 2026
CVE-2026-33811	When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…	7.5 High	May 7, 2026
CVE-2026-40976	In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all…	9.1 Critical	Apr 27, 2026
CVE-2026-40975	Values produced by ${random.value} are not suitable for use as secrets	4.8 Medium	Apr 27, 2026
CVE-2026-40542	Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept…	Not rated	Apr 22, 2026
CVE-2026-3505	Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the…	8.7 High	Apr 15, 2026
CVE-2026-5598	Covert timing channel vulnerability in Legion of the Bouncy Castle Inc	8.9 High	Apr 15, 2026

Other Red Hat products