Netty has Insufficient Bailiwick Validation for NS Records

Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

CVE-2026-33816 in github.com/jackc/pgx

CVE-2026-33815 in github.com/jackc/pgx

lodash vulnerable to Code Injection via `_.template` imports key names

Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh

Netty: HttpClientCodec response desynchronization

Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

undici vulnerable to cross-origin request routing via SOCKS5 proxy pool reuse

Quarkus authorization bypass via semicolon path normalization inconsistency

Case-sensitive excludedSubtrees name constraints cause Auth Bypass in crypto/x509

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

undici WebSocket client vulnerable to denial of service via fragment count bypass

ws: Memory exhaustion DoS from tiny fragments and data chunks

form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection)

Netty's wrapping plain trust manager silently disables hostname verification

Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion

netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes

Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

iskorotkov/avro: CPU Exhaustion in Avro Decoder

iskorotkov/avro: Integer Overflow in Avro Decoder

Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh

ws: Uninitialized memory disclosure

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Crash when handling long CNAME response in net

Apache Thrift: Specially crafted input can crash a c_glib Thrift server with invalid pointer error.

follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets

Unexpected work during chain building in crypto/x509

Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

Go JOSE affect by a panic in JWE decryption

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent

Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling

Apache Thrift: TSSLTransportFactory.java hostname verification

Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh

Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions