{
  "fix": "SUSE-SU-2026:4391-1",
  "url": "https://patchblox.com/security/fix/linux/suse-su-2026-4391-1",
  "summary": "SUSE-SU-2026:4391-1, released September 29, 2026, fixes 30 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.",
  "platform": "linux",
  "type": "advisory",
  "title": "Security update for 2 packages",
  "released": "2026-09-29T11:47:41Z",
  "priority": "High",
  "priorityTier": 3,
  "priorityReason": "Closes CVE-2026-62243, high severity",
  "supported": true,
  "cveCount": 30,
  "exploitedCveCount": 0,
  "kevCveCount": 0,
  "ransomwareCveCount": 0,
  "maxEpss": 0.02885,
  "maxCvss": 7.5,
  "vendorAdvisory": "https://osv.dev/vulnerability/SUSE-SU-2026:4391-1",
  "appliesTo": [
    {
      "product": "netty",
      "productUrl": "https://patchblox.com/security/product/linux/netty",
      "release": "sles 15.7",
      "fixedVersion": "4.1.138-150200.4.56.1",
      "supported": true
    },
    {
      "product": "netty-tcnative",
      "productUrl": "https://patchblox.com/security/product/linux/netty-tcnative",
      "release": "sles 15.6",
      "fixedVersion": "2.0.84-150200.3.51.1",
      "supported": true
    },
    {
      "product": "netty-tcnative",
      "productUrl": "https://patchblox.com/security/product/linux/netty-tcnative",
      "release": "sles 15.7",
      "fixedVersion": "2.0.84-150200.3.51.1",
      "supported": true
    }
  ],
  "cves": [
    {
      "cveId": "CVE-2026-62243",
      "url": "https://patchblox.com/security/cve/CVE-2026-62243",
      "title": "netty-tcnative: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455).",
      "priority": "High",
      "severity": "important",
      "cvss": 7.5,
      "epss": 0.00155,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93567",
      "url": "https://patchblox.com/security/cve/CVE-2026-93567",
      "title": "netty-tcnative: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled",
      "priority": "Routine",
      "epss": 0.02885,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93569",
      "url": "https://patchblox.com/security/cve/CVE-2026-93569",
      "title": "netty-tcnative: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target",
      "priority": "Routine",
      "epss": 0.02417,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93574",
      "url": "https://patchblox.com/security/cve/CVE-2026-93574",
      "title": "netty-tcnative: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374).",
      "priority": "Routine",
      "epss": 0.0167,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93558",
      "url": "https://patchblox.com/security/cve/CVE-2026-93558",
      "title": "netty-tcnative: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service",
      "priority": "Routine",
      "epss": 0.01223,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93573",
      "url": "https://patchblox.com/security/cve/CVE-2026-93573",
      "title": "netty-tcnative: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373).",
      "priority": "Routine",
      "epss": 0.0108,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93579",
      "url": "https://patchblox.com/security/cve/CVE-2026-93579",
      "title": "netty-tcnative: HTTP/2 header field values are not validated by default (bsc#1282378).",
      "priority": "Routine",
      "epss": 0.0108,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93568",
      "url": "https://patchblox.com/security/cve/CVE-2026-93568",
      "title": "netty-tcnative: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370).",
      "priority": "Routine",
      "epss": 0.01077,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93564",
      "url": "https://patchblox.com/security/cve/CVE-2026-93564",
      "title": "netty-tcnative: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363).",
      "priority": "Routine",
      "epss": 0.01059,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93488",
      "url": "https://patchblox.com/security/cve/CVE-2026-93488",
      "title": "netty-tcnative: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084).",
      "priority": "Routine",
      "epss": 0.00955,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93491",
      "url": "https://patchblox.com/security/cve/CVE-2026-93491",
      "title": "netty-tcnative: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085).",
      "priority": "Routine",
      "epss": 0.00881,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93565",
      "url": "https://patchblox.com/security/cve/CVE-2026-93565",
      "title": "netty-tcnative: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364).",
      "priority": "Routine",
      "epss": 0.00865,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93566",
      "url": "https://patchblox.com/security/cve/CVE-2026-93566",
      "title": "netty-tcnative: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366).",
      "priority": "Routine",
      "epss": 0.00578,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93562",
      "url": "https://patchblox.com/security/cve/CVE-2026-93562",
      "title": "netty-tcnative: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362).",
      "priority": "Routine",
      "epss": 0.00494,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93492",
      "url": "https://patchblox.com/security/cve/CVE-2026-93492",
      "title": "netty-tcnative: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132).",
      "priority": "Routine",
      "epss": 0.00481,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93494",
      "url": "https://patchblox.com/security/cve/CVE-2026-93494",
      "title": "netty-tcnative: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506).",
      "priority": "Routine",
      "epss": 0.0041,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93560",
      "url": "https://patchblox.com/security/cve/CVE-2026-93560",
      "title": "netty-tcnative: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141).",
      "priority": "Routine",
      "epss": 0.0041,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93575",
      "url": "https://patchblox.com/security/cve/CVE-2026-93575",
      "title": "netty-tcnative: missing validations in the \u0060MqttDecoder\u0060 can lead to excessive resource consumption and a DoS",
      "priority": "Routine",
      "epss": 0.00388,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75596",
      "url": "https://patchblox.com/security/cve/CVE-2026-75596",
      "title": "netty-tcnative: fragmented \u0060ClientHello\u0060records can trigger quadratic pre-handshake reassembly in default SNI parsing",
      "priority": "Routine",
      "epss": 0.00374,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-59902",
      "url": "https://patchblox.com/security/cve/CVE-2026-59902",
      "title": "netty-tcnative: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501).",
      "priority": "Routine",
      "epss": 0.00365,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93572",
      "url": "https://patchblox.com/security/cve/CVE-2026-93572",
      "title": "netty-tcnative: multiplication of patched preallocation limits in \u0060RedisArrayAggregator\u0060 nested RESP headers can lead",
      "priority": "Routine",
      "epss": 0.00339,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93563",
      "url": "https://patchblox.com/security/cve/CVE-2026-93563",
      "title": "netty-tcnative: unbounded multi-line response accumulation in \u0060SmtpResponseDecoder\u0060 leads to memory exhaustion and a",
      "priority": "Routine",
      "epss": 0.00325,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-59903",
      "url": "https://patchblox.com/security/cve/CVE-2026-59903",
      "title": "netty-tcnative: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite",
      "priority": "Routine",
      "severity": "moderate",
      "cvss": 6.5,
      "epss": 0.00324,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-75595",
      "url": "https://patchblox.com/security/cve/CVE-2026-75595",
      "title": "netty-tcnative: fragmented TLS \u0060ClientHello\u0060 causes fallback to default \u0060SslContext\u0060 and allows for SNI routing and",
      "priority": "Routine",
      "epss": 0.00316,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-89044",
      "url": "https://patchblox.com/security/cve/CVE-2026-89044",
      "title": "netty-tcnative: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding",
      "priority": "Routine",
      "epss": 0.00284,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93576",
      "url": "https://patchblox.com/security/cve/CVE-2026-93576",
      "title": "netty-tcnative: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507).",
      "priority": "Routine",
      "epss": 0.0027,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-62380",
      "url": "https://patchblox.com/security/cve/CVE-2026-62380",
      "title": "netty-tcnative: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456).",
      "priority": "Routine",
      "epss": 0.00253,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93578",
      "url": "https://patchblox.com/security/cve/CVE-2026-93578",
      "title": "netty-tcnative: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass",
      "priority": "Routine",
      "epss": 0.00226,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-93493",
      "url": "https://patchblox.com/security/cve/CVE-2026-93493",
      "title": "netty-tcnative: missing \u0060nextUpdate\u0060 field in OCSP responses leads to silent validation bypass (bsc#1281431).",
      "priority": "Routine",
      "epss": 0.00218,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    },
    {
      "cveId": "CVE-2026-76816",
      "url": "https://patchblox.com/security/cve/CVE-2026-76816",
      "title": "netty-tcnative: missing input validation in \u0060MqttEncoder\u0060 allows for null-byte injection, topic hijacking, and ACL",
      "priority": "Routine",
      "epss": 0.00174,
      "kev": false,
      "ransomware": false,
      "exploited": false,
      "disclosed": false
    }
  ],
  "dataAsOf": "2026-11-11T19:49:26Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}