Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object, PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is a network application framework for development of protocol servers and clients. Prior to
    versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises
    maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts
    SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value).
    Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server
    advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object,
    PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs
    a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the
    precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap
    multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-47244)

The version of IBM Cognos Analytics installed on the remote host is 12.0.4 prior to 12.0.4 FP3, or 12.1.x prior to 12.1.3 FP2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No.
7287209:

  - NLTK versions 3.9.2 and prior are vulnerable to arbitrary code execution due to improper input     validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files     without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the     execution of arbitrary Java bytecode at import time. (CVE-2026-0848)

  - The lodash fix for CVE-2021-23337 added validation for the variable option in _.template but did not     apply the same validation to options.imports key names. Both paths flow into the same Function()     constructor sink. When an application passes untrusted input as options.imports key names, an attacker     can inject default-parameter expressions that execute arbitrary code at template compilation time.
    (CVE-2026-4800)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python     buffers (e.g. Hash.update()), this could lead to buffer overflows. (CVE-2026-39892)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2802-1 advisory.

    This update for netty, netty-tcnative fixes the following issue

    This update for netty, netty-tcnative fixes the following issues

    Upgrade netty to upstream version 4.1.135, netty-tcnative to upstream version 2.0.79:

    - CVE-2026-44249: IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (bsc#1268165).
    - CVE-2026-44250: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (bsc#1268169).
    - CVE-2026-44890: Unbounded Direct Memory Consumption in RedisDecoder (bsc#1268170).
    - CVE-2026-44893: netty-codec-haproxy: Denial of Service via malformed HAProxy message (bsc#1268244).
    - CVE-2026-45416: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (bsc#1268246).
    - CVE-2026-45536: Unix-socket fd receive leaks descriptors when peer sends two at once (bsc#1268247).
    - CVE-2026-45673: netty-resolver-dns: DNS Cache Poisoning via predictable transaction IDs (bsc#1268248).
    - CVE-2026-45674: DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (bsc#1268249).
    - CVE-2026-46340: netty-transport-sctp: Denial of Service due to unbounded memory growth from SctpMessage     fragments       (bsc#1268250).
    - CVE-2026-47244: HTTP/2: Advertised MAX_CONCURRENT_STREAMS not enforced (bsc#1268251).
    - CVE-2026-47691: Insufficient Bailiwick Validation for NS Records (bsc#1268252).
    - CVE-2026-48006: netty-codec-redis: Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in       RedisArrayAggregator (bsc#1268255).
    - CVE-2026-48043: netty-codec-http2: Denial of Service due to resource leak (bsc#1268257).
    - CVE-2026-48059: netty-codec-haproxy: Denial of Service via memory leak from crafted PROXY protocol     headers       (bsc#1268258).
    - CVE-2026-50010: Wrapping plain trust manager silently disables hostname verification (bsc#1268259).
    - CVE-2026-50011: Unbounded pre-allocation in RedisArrayAggregator from RESP array length (bsc#1268260).
    - CVE-2026-50020: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF     characters are       permitted (bsc#1268261).
    - CVE-2026-50560: Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature     (bsc#1268262).

    Changes:

     - MQTT: Allow MQTT 5 CONNECT with password only      + ChannelInitializer: correct misleading comment on      exceptionCaught route      + HTTP/2: Parse request-target path like Vert.x (4.1 backport)      + HttpObjectDecoder skips arbitrary initial control characters      when only initial CRLF characters are permitted      + IpSubnetFilter: Correctly handle ipv6      + Configurable bound on RedisArrayAggregator      + Redis: Limit decoded length      + DNS: Ensure query id is not predictible      + Wrapping plain trust manager silently disables hostname      verification      + MQTT: Reject malformed no-payload packets with non-zero      Remaining Length      + HAProxy: Reject HAProxyMessages with malformated TLV and not      leak memory      + SSL: Use sane defaults as limits for the client hello length      and timeout      + DNS: Only cache CNAME if part of the queried domain      + HTTP/2: Enforce max concurrent streams for misbehaving clients      + Dns: Insufficient Bailiwick Validation for NS Records      + HTTP2: DelegatingDecompressorFrameListener must release memory      in all cases      + Pass maxAllocation to Brotli and Zstd decoders      + HTTP/2: Treat clients MAX_HEADER_LIST_SIZE as advisory      + Add maxWindowLog parameter to ZstdDecoder to bound memory      allocation      + HAProxy: Fix ByteBuf leak when parsing nested SSL TLVs      + Epoll / Kqueue: Correctly handle receive of FD      + SCTP: Limit the number of inflight incomplete SCTP messages      and the number of fragments      + Redis: Correctly release incomplete message on removal when      using RedisArrayAggregator      + Redis: Limit the maximum number of nested arrays      + HTTP: Re-add constructor to HttpProxyHandler that was removed      by mistake      + Marshalling: Explicit document security requirements      + Pin HTTP/RTSP version + method normalization to Locale.US      + Adaptive: Fix concurrency issue in adaptive allocator      + Pin multipart Content-Type / Content-Transfer-Encoding case      folding to Locale.US      + Remove dead native declarations      + Avoid re-parsing openssl key material with non-cached provider      + IpFilter: Fix ClassCastException caused by IpSubnetFilter if      only ipv6 rules are configured but remote peer is using ipv4      + Resolve all localhost addresses without querying DNS servers      + HTTP2: Use 100 as default max concurrent streams setting      + Route synchronous onLookupComplete exceptions via      fireExceptionCaught      + Fix MQTT decoder size check after variable header replay

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is a network application framework for development of protocol servers and clients. Prior to     versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises     maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts     SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value).
    Unless the application explicitly calls initialSettings().maxConcurrentStreams(n), a Netty HTTP/2 server     advertises no limit and enforces none locally. Each open stream allocates a DefaultStream object,     PropertyMap slots, flow-controller state and IntObjectHashMap entry; with ~2^30 permissible odd stream IDs     a single TCP connection can create hundreds of thousands of long-lived stream objects. This is also the     precondition for CVE-2023-44487-style Rapid-Reset amplification, where the absence of a low concurrent cap     multiplies backend work. Versions 4.1.135.Final and 4.2.15.Final patch the issue. (CVE-2026-47244)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460989	Echo: io.netty:netty-codec-http2: security update to 4.1.135.Final	Tenable Cloud Security	Echo Local Security Checks	Local	medium
460989	Echo: io.netty:netty-codec-http2: security update to 4.1.135.Final	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
347960	IBM Cognos Analytics 12.0.4 < 12.0.4 FP3 / 12.1.x < 12.1.3 FP2 Multiple Vulnerabilities (7287209)	Nessus	CGI abuses	Remote	high
326003	SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:2802-1)	Nessus	SuSE Local Security Checks	Local	high
320907	Linux Distros Unpatched Vulnerability : CVE-2026-47244	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-47244

medium

Tenable Plugins

medium

medium

high

high

medium