{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-100662", "tracking": { "current_release_date": "2026-10-16T10:46:18.774713Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-100662", "initial_release_date": "2026-09-26T14:28:42.720110Z", "revision_history": [ { "date": "2026-09-26T14:28:42.720110Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-09-26T14:28:49.510167Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-27T00:44:52.433345Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Products connected (1)." }, { "date": "2026-09-27T06:44:45.606444Z", "number": "4", "summary": "Description created for source." }, { "date": "2026-09-27T06:58:09.449971Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (19).| References created (4).| CWES updated (1)." }, { "date": "2026-09-27T06:58:14.510946Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-09-27T12:27:44.436654Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (6).| Product Identifiers created (2).| References created (4).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-27T12:27:46.808177Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-09-27T15:14:59.158126Z", "number": "9", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-28T09:24:58.623269Z", "number": "10", "summary": "Source connected.| CVE status created. (valid)| Products connected (2).| References created (32)." }, { "date": "2026-09-28T09:25:00.835854Z", "number": "11", "summary": "NCSC Score updated." }, { "date": "2026-09-28T12:41:31.937151Z", "number": "12", "summary": "CVSS created.| CWES created (1).| Products created (3).| References created (2).| Description created for source.| Unknown change.| Product Identifiers created (1)." }, { "date": "2026-09-28T12:41:33.803206Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-09-29T16:13:08.270542Z", "number": "14", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-29T16:13:13.896876Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-09-30T12:05:11.871922Z", "number": "16", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-09-30T12:05:14.742817Z", "number": "17", "summary": "NCSC Score updated." }, { "date": "2026-09-30T15:45:01.559895Z", "number": "18", "summary": "Unknown change." }, { "date": "2026-10-01T13:24:22.132432Z", "number": "19", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-10-01T13:24:24.766200Z", "number": "20", "summary": "NCSC Score updated." }, { "date": "2026-10-09T12:10:50.558473Z", "number": "21", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-10-09T12:10:57.508127Z", "number": "22", "summary": "NCSC Score updated." }, { "date": "2026-10-16T10:46:11.434306Z", "number": "23", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-10-16T10:46:13.142880Z", "number": "24", "summary": "NCSC Score updated." } ], "status": "interim", "version": "24" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<4.1.138.final", "product": { "name": "vers:unknown/<4.1.138.final", "product_id": "CSAFPID-9211558" } }, { "category": "product_version_range", "name": "vers:unknown/<4.2.18.final", "product": { "name": "vers:unknown/<4.2.18.final", "product_id": "CSAFPID-9211559" } } ], "category": "product_name", "name": "Netty" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317175", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "product_name", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1439279", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_ai" } } } ], "category": "product_name", "name": "Red Hat OpenShift AI (RHOAI)" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/3", "product": { "name": "vers:rpm/3", "product_id": "CSAFPID-1441150", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_devspaces:3" } } } ], "category": "product_name", "name": "Red Hat OpenShift Dev Spaces" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9116089" } } ], "category": "product_name", "name": "odh-th-torch-cpu-py312-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9116090" } } ], "category": "product_name", "name": "odh-th-torch-cuda-py312-rhel9" } ], "category": "product_family", "name": "Red Hat OpenShift AI (RHOAI)" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-4534155" } } ], "category": "product_name", "name": "openvsx-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2577689" } } ], "category": "product_name", "name": "pluginregistry-rhel9" } ], "category": "product_family", "name": "Red Hat OpenShift Dev Spaces" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/analytic server", "product": { "name": "vers:unknown/analytic server", "product_id": "CSAFPID-2608554", "product_identification_helper": { "cpe": "cpe:/a:ibm:spss:analytic_server" } } } ], "category": "product_name", "name": "SPSS" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317176", "product_identification_helper": { "cpe": "cpe:/o:suse:opensuse:-" } } } ], "category": "product_name", "name": "SUSE openSUSE" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317174", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "product_name", "name": "SuSE Linux" } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/*", "product": { "name": "vers:deb/*", "product_id": "CSAFPID-2758694" } } ], "category": "product_name", "name": "netty" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/4.2.0.final|<4.2.18.final", "product": { "name": "vers:unknown/4.2.0.final|<4.2.18.final", "product_id": "CSAFPID-9478813" } }, { "category": "product_version_range", "name": "vers:unknown/4.2.18.final", "product": { "name": "vers:unknown/4.2.18.final", "product_id": "CSAFPID-9478814" } }, { "category": "product_version_range", "name": "vers:unknown/>=4.2.0.final|<=4.2.18.final", "product": { "name": "vers:unknown/>=4.2.0.final|<=4.2.18.final", "product_id": "CSAFPID-9478817", "product_identification_helper": { "cpe": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*" } } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.0.final", "product": { "name": "vers:unknown/netty-4.2.0.final", "product_id": "CSAFPID-3725552" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.1.final", "product": { "name": "vers:unknown/netty-4.2.1.final", "product_id": "CSAFPID-3725557" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.10.final", "product": { "name": "vers:unknown/netty-4.2.10.final", "product_id": "CSAFPID-8601805" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.11.final", "product": { "name": "vers:unknown/netty-4.2.11.final", "product_id": "CSAFPID-8601804" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.12.final", "product": { "name": "vers:unknown/netty-4.2.12.final", "product_id": "CSAFPID-8601802" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.13.final", "product": { "name": "vers:unknown/netty-4.2.13.final", "product_id": "CSAFPID-8602905" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.14.final", "product": { "name": "vers:unknown/netty-4.2.14.final", "product_id": "CSAFPID-8602903" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.15.final", "product": { "name": "vers:unknown/netty-4.2.15.final", "product_id": "CSAFPID-8858722" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.16.final", "product": { "name": "vers:unknown/netty-4.2.16.final", "product_id": "CSAFPID-9003494" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.17.final", "product": { "name": "vers:unknown/netty-4.2.17.final", "product_id": "CSAFPID-9211844" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.2.final", "product": { "name": "vers:unknown/netty-4.2.2.final", "product_id": "CSAFPID-3725558" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.3.final", "product": { "name": "vers:unknown/netty-4.2.3.final", "product_id": "CSAFPID-3725559" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.4.final", "product": { "name": "vers:unknown/netty-4.2.4.final", "product_id": "CSAFPID-3725560" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.5.final", "product": { "name": "vers:unknown/netty-4.2.5.final", "product_id": "CSAFPID-5100274" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.6.final", "product": { "name": "vers:unknown/netty-4.2.6.final", "product_id": "CSAFPID-5100275" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.7.final", "product": { "name": "vers:unknown/netty-4.2.7.final", "product_id": "CSAFPID-5269726" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.8.final", "product": { "name": "vers:unknown/netty-4.2.8.final", "product_id": "CSAFPID-6453535" } }, { "category": "product_version_range", "name": "vers:unknown/netty-4.2.9.final", "product": { "name": "vers:unknown/netty-4.2.9.final", "product_id": "CSAFPID-6453536" } }, { "category": "product_version_range", "name": "vers:unknown/netty-clang-bin", "product": { "name": "vers:unknown/netty-clang-bin", "product_id": "CSAFPID-9211842" } } ], "category": "product_name", "name": "netty" } ], "category": "vendor", "name": "netty" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-100662", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the \"Insert With Literal Name\" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-100662" }, { "category": "description", "text": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the \"Insert With Literal Name\" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100662.json?alt=media" }, { "category": "description", "text": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the \"Insert With Literal Name\" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-100662" }, { "category": "description", "text": "Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the \"Insert With Literal Name\" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-100662" }, { "category": "description", "text": "A flaw was found in Netty's HTTP/3 codec. A remote, unauthenticated attacker can cause a Denial of Service (DoS) by establishing an HTTP/3 connection and sending stream instructions that declare excessively large field lengths without delivering the complete data. Because the server does not enforce size limits on these instructions, it continuously allocates and retains connection buffers until memory is exhausted, resulting in an application crash.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-100662" }, { "category": "other", "text": "0.00343", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "8.7", "title": "CVSSV4 base score" }, { "category": "other", "text": "3.9", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Certbundde", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score, Is related to a product by vendor Open Source, Is related to a product by vendor Ibm", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 3\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-1439279", "CSAFPID-1441150", "CSAFPID-2577689", "CSAFPID-4534155", "CSAFPID-9116089", "CSAFPID-9116090", "CSAFPID-9211558", "CSAFPID-9211559", "CSAFPID-9478813", "CSAFPID-9478817", "CSAFPID-1317174", "CSAFPID-1317176", "CSAFPID-3725552", "CSAFPID-3725557", "CSAFPID-8601805", "CSAFPID-8601804", "CSAFPID-8601802", "CSAFPID-8602905", "CSAFPID-8602903", "CSAFPID-8858722", "CSAFPID-9003494", "CSAFPID-9211844", "CSAFPID-3725558", "CSAFPID-3725559", "CSAFPID-3725560", "CSAFPID-5100274", "CSAFPID-5100275", "CSAFPID-5269726", "CSAFPID-6453535", "CSAFPID-6453536", "CSAFPID-9211842", "CSAFPID-2608554", "CSAFPID-1317175" ], "known_not_affected": [ "CSAFPID-2758694", "CSAFPID-9478814" ] }, "references": [ { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100662" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-100662" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100662" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-100662" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3291.json" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100662" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100662.json?alt=media" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://access.redhat.com/errata/RHSA-2026:83612" }, { "category": "external", "summary": "Reference - certbundde; cveprojectv5; nvd; osv; redhat", "url": "https://github.com/netty/netty/security/advisories/GHSA-f64r-x647-cg8w" }, { "category": "external", "summary": "Reference - cveprojectv5; nvd; osv; redhat", "url": "https://www.vulncheck.com/advisories/netty-http-3-qpack-encoder-stream-unbounded-memory-exhaustion-dos" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100662" }, { "category": "external", "summary": "Reference - osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100662" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3291.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3291" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-2g37-3h88-55hc" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-45h4-vhwh-fmhg" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-495p-pchh-r4mc" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-5vh9-c45f-rf7p" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-8352-h356-c9qh" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-8whp-c7w8-2m72" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-cg2g-fxr4-mg8m" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-ghg5-c4jg-8q5j" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-h75q-xqrh-59rf" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-hfr2-x62w-v49h" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-hmf3-49g9-g7qq" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-j4mg-hqgv-34qc" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-j58c-g352-8h4p" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-jgph-cgq3-c627" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-jhjp-5q4f-8wr2" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-jj3c-mwvr-9g52" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-jqf3-r9ww-c5x8" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-mj35-3qqm-q387" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-pq4x-537v-r54q" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-pvjx-v7vp-62vq" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-q9pg-8h3j-8hvm" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-r4xx-7fpg-j8xg" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-rmcw-9fcq-wjq7" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-v5p2-hmgx-3xrx" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-w6j8-x45j-w75f" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/netty/netty/security/advisories/GHSA-wxrh-4rgq-pjcg" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-September/029455.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GHLPH6OXFMQ7R346ZKQZMBEXEHX7YG6T/" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7291775" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100662.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1317174", "CSAFPID-1317175", "CSAFPID-1317176", "CSAFPID-1439279", "CSAFPID-1441150", "CSAFPID-2577689", "CSAFPID-2608554", "CSAFPID-3725552", "CSAFPID-3725557", "CSAFPID-3725558", "CSAFPID-3725559", "CSAFPID-3725560", "CSAFPID-4534155", "CSAFPID-5100274", "CSAFPID-5100275", "CSAFPID-5269726", "CSAFPID-6453535", "CSAFPID-6453536", "CSAFPID-8601802", "CSAFPID-8601804", "CSAFPID-8601805", "CSAFPID-8602903", "CSAFPID-8602905", "CSAFPID-8858722", "CSAFPID-9003494", "CSAFPID-9116089", "CSAFPID-9116090", "CSAFPID-9211558", "CSAFPID-9211559", "CSAFPID-9211842", "CSAFPID-9211844", "CSAFPID-9478813", "CSAFPID-9478817" ] } ], "title": "CVE-2026-100662" } ] }