Netty Vulnerabilities Allow Bypass and Denial of Service

CERT-Bund has released a security advisory (WID-SEC-2026-0846) detailing multiple vulnerabilities in the Netty asynchronous network application framework. The vulnerabilities, rated with a CVSS Base Score of 7.5 (High) and Temporal Score of 6.7 (Medium), can be exploited by remote, anonymous attackers to bypass security controls and induce a denial-of-service condition. The advisory specifically identifies affected versions as Open Source Netty <4.2.11 and <4.1.132, impacting Linux and UNIX operating systems.

Organizations utilizing Netty in their applications should immediately assess their exposure to these vulnerabilities. The advisory indicates that mitigation is available, and users are strongly advised to update to the patched versions (Netty 4.2.11 and 4.1.132, or later) as soon as possible to prevent potential security breaches and service disruptions. Failure to apply these updates could lead to successful exploitation by malicious actors, compromising system integrity and availability.