Amq Clients (Redhat) - vulnerabilities (CVEs)

35 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-09-18. Vendor: Redhat.

CVEs of Amq Clients

• CVE-2026-93562 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request…
• CVE-2026-93574 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1…
• CVE-2026-93573 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the…
• CVE-2026-93566 - CVSS 6.5 (medium), 2026-09-18: A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the…
• CVE-2026-93565 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time…
• CVE-2026-93558 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to…
• CVE-2026-93491 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single…
• CVE-2026-93488 - CVSS 7.5 (high), 2026-09-18: A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to…
• CVE-2026-57915 - CVSS 7.3 (high), 2026-06-26: It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are…
• CVE-2026-54513 - CVSS 8.1 (high), 2026-06-23: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and…
• CVE-2026-50010 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
• CVE-2026-45416 - CVSS 7.5 (high), 2026-06-12: Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final,…
• CVE-2026-44249 - CVSS 8.1 (high), 2026-06-11: Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final,…
• CVE-2026-40984 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions:…
• CVE-2026-40983 - CVSS 7.5 (high), 2026-06-09: In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions:…
• CVE-2026-42584 - CVSS 9.1 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response…
• CVE-2026-42587 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation…
• CVE-2026-42581 - CVSS 9.8 (critical), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting…
• CVE-2026-42578 - CVSS 7.5 (high), 2026-05-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP…
• CVE-2026-33811 - CVSS 7.5 (high), 2026-05-07: When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
• CVE-2026-40976 - CVSS 9.1 (critical), 2026-04-28: In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be…
• CVE-2026-40975 - CVSS 8.2 (high), 2026-04-28: Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used…
• CVE-2026-40542 - CVSS 7.3 (high), 2026-04-22: Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to cause the client to accept SCRAM-SHA-256 authentication without proper…
• CVE-2026-5598 - CVSS 8.9 (high), 2026-04-15: Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program…
• CVE-2026-3505 - CVSS 8.7 (high), 2026-04-15: Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all…
• CVE-2026-0636 - CVSS 6.5 (medium), 2026-04-15: Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all…
• CVE-2025-14813 - CVSS 9.3 (critical), 2026-04-15: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcprov on all (core modules). This vulnerability…
• CVE-2026-33870 - CVSS 7.5 (high), 2026-03-27: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted…
• CVE-2026-33871 - CVSS 8.7 (high), 2026-03-27: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial…
• CVE-2025-67030 - CVSS 8.8 (high), 2026-03-25: Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before…
• CVE-2026-33210 - CVSS 9.1 (critical), 2026-03-20: Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability…
• CVE-2026-25679 - CVSS 7.5 (high), 2026-03-06: url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
• CVE-2026-27446 - CVSS 9.8 (critical), 2026-03-04: Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use…
• CVE-2025-61726 - CVSS 7.5 (high), 2026-01-28: The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited…
• CVE-2026-0994 - CVSS 8.2 (high), 2026-01-23: A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when…