CVE-2026-44249
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final a
CVSS
8.1
High
EPSS
0.6%
p43
KEV
—
Exploit Today
13
0-100
Published: Jun 11, 2026 · Last modified: Jul 15, 2026 · CWE-284 · CWE-697 · CWE-1287
0.6%EPSS · 30 days0.6%
2026-06-302026-07-16
Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.
- github.comhttps://github.com/netty/netty/releases/tag/netty-4.1.135.Final
- github.comhttps://github.com/netty/netty/releases/tag/netty-4.2.15.Final
- github.comhttps://github.com/netty/netty/security/advisories/GHSA-3qp7-7mw8-wx86
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:26017
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:26018
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:26586
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:28573
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:34608
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:36820
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:37390
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-44249
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2488081
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44249.json
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-503517.8 HIG83.0%
——25Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally.11hCVE-2026-256397.5 HIG82.9%
——25Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.15hCVE-2026-504237.8 HIG82.7%
——25Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally.2dCVE-2023-285319.8 CRI81.1%
——24ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.3dCVE-2026-393647.5 HIG79.6%
——24Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.deny (e.g., .env, *.crt) can be retrieved with HTTP 200 responses when query parameters such as ?raw, ?import&raw, or ?import&url&inline are appended. This vulnerability is fixed in 7.3.2 and 8.0.5.2dCVE-2026-498057.0 HIG79.5%
——24Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally.12h