Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 488
Alerts This Week
Warning Icon 1 488

SUSE Linux 15.6 Netty 2026-1353-1 Important Request Smuggling

suse
Calendar Grey April 15, 2026
Scroller Suse
Two vulnerabilities in Netty and Netty-tcnative resolved in SUSE's important security update.
An update that solves two vulnerabilities can now be installed.

Summary

## This update for netty, netty-tcnative fixes the following issues: Upidate to 4.1.132: * CVE-2026-33870: incorrectly parses quoted strings in HTTP/1.1 can lead to request smuggling (bsc#1261031). * CVE-2026-33871: sending a flood of CONTINUATION frames can lead to a denial of service (bsc#1261043). Changelog: * Upgrade to upstream version 4.1.132 * Fixes: * Fix Incorrect nanos-to-millis conversion in epoll_wait EINTR retry loop * Make RefCntOpenSslContext.deallocate more robust * HTTP2: Correctly account for padding when decompress * Fix high-order bit aliasing in HttpUtil.validateToken * fix: the precedence of + is higher than >> * AdaptiveByteBufAllocator: make sure byteBuf.capacity() not greater than byteBuf.maxCapacity()

Topics%20covered

Topics Covered

security advisory denial of service SuSE important request smuggling netty

References

* bsc#1261031

* bsc#1261043

Cross-

* CVE-2026-33870

* CVE-2026-33871

CVSS scores:

* CVE-2026-33870 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

* CVE-2026-33870 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

* CVE-2026-33870 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

* CVE-2026-33871 ( SUSE ): 8.2

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2026-33871 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2026-33871 ( NVD ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2026:1353-1
Release Date: 2026-04-15T13:37:31Z
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service SuSE important request smuggling netty

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.