CLSA-2026-1793621110: TuxCare security update for io.netty (17 CVEs)
Published Nov 2, 2026
·Updated
TuxCare rebuilt 10 io.netty packages to address 17 CVEs. Fixed in 4.1.49.Final-tuxcare.6.
Affected Software
10 affected componentsFixes available
tuxcare/io.netty:netty-codec-dns>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
tuxcare/io.netty:netty-codec-haproxy>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
tuxcare/io.netty:netty-codec-http>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
tuxcare/io.netty:netty-codec-http2>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
tuxcare/io.netty:netty-codec-mqtt>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
tuxcare/io.netty:netty-codec-redis>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
tuxcare/io.netty:netty-codec-smtp>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
tuxcare/io.netty:netty-common>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
tuxcare/io.netty:netty-handler>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
tuxcare/io.netty:netty-transport-sctp>=4.1.49.Final<4.1.49.Final-tuxcare.6
4.1.49.Final-tuxcare.6
Event History
Nov 2, 2026
Advisory Published
via OSV·01:05 PM
Data Sourced
via OSV·01:05 PM
DescriptionAffected Software
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
1
Which components are included in this update?
The update covers netty-codec-dns, netty-codec-haproxy, netty-codec-http, netty-codec-http2, netty-codec-mqtt, netty-codec-redis, netty-codec-smtp, and netty-common. The advisory states that 10 io.netty packages were rebuilt, but only these eight package names are listed.
2
What fixed version should be deployed?
Deploy io.netty packages fixed in version 4.1.49.Final-tuxcare.6.