CWE-1035: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

What the weakness is: CWE-1035 at MITRE. OWASP Top 10: A03:2025 Software Supply Chain Failures. All weaknesses

1. 6.5CVE-2026-93562EPSS 0.5%2026-09-18

   A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitra…

2. 6.5CVE-2026-93579EPSS 1.1%2026-09-18

   A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these …

3. 6.5CVE-2026-93566EPSS 0.6%2026-09-18

   A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to…

4. 7.5CVE-2026-93565EPSS 0.9%2026-09-18

   A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a speci…

5. 7.5CVE-2026-93564EPSS 1.1%2026-09-18

   A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Den…

6. 7.5CVE-2026-93558EPSS 1.2%2026-09-18

   A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounde…

7. 7.5CVE-2026-93560EPSS 0.4%2026-09-18

   A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decod…

8. 5.3CVE-2026-93492EPSS 0.5%2026-09-18

   A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, lea…

9. 5.9CVE-2026-93578EPSS 0.2%2026-09-18

   A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issu…

10. 7.5CVE-2026-93575EPSS 0.4%2026-09-18

    A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Rema…

11. 7.5CVE-2026-93563EPSS 0.3%2026-09-18

    A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a …

12. 6.5CVE-2026-93561EPSS 0.2%2026-09-18

    A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can …

13. 7.5CVE-2026-93494EPSS 0.4%2026-09-18

    A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (…