Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure default configuration allows a malicious client or server to send an enormous number of headers, leading to a memory exhaustion Denial of Service via an `OutOfMemoryError`. Version 4.2.15.Final contains a patch.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. Prior to version
    4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an
    enforced maximum header size limit. When a peer does not explicitly specify
    `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure
    default configuration allows a malicious client or server to send an enormous number of headers, leading
    to a memory exhaustion Denial of Service via an `OutOfMemoryError`. Version 4.2.15.Final contains a patch.
    (CVE-2026-44892)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. Prior to version     4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an     enforced maximum header size limit. When a peer does not explicitly specify     `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure     default configuration allows a malicious client or server to send an enormous number of headers, leading     to a memory exhaustion Denial of Service via an `OutOfMemoryError`. Version 4.2.15.Final contains a patch.
    (CVE-2026-44892)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459397	Echo: io.netty:netty-codec-http3: security update to 4.2.15.Final	Tenable Cloud Security	Echo Local Security Checks	Local	high
459397	Echo: io.netty:netty-codec-http3: security update to 4.2.15.Final	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
320836	Linux Distros Unpatched Vulnerability : CVE-2026-44892	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-44892

high

Tenable Plugins

Coming Soon

high

high

high