# SUSE-SU-2026:4391-1: Security update for 2 packages

SUSE-SU-2026:4391-1, released September 29, 2026, fixes 30 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-4391-1
- Platform: Linux
- Released: Sep 29, 2026
- Priority: High (Closes CVE-2026-62243, high severity)
- CVEs: 30, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:4391-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [netty](https://patchblox.com/security/data/product/linux/netty.md) | sles 15.7 | 4.1.138-150200.4.56.1 |
| [netty-tcnative](https://patchblox.com/security/data/product/linux/netty-tcnative.md) | sles 15.6 | 2.0.84-150200.3.51.1 |
| [netty-tcnative](https://patchblox.com/security/data/product/linux/netty-tcnative.md) | sles 15.7 | 2.0.84-150200.3.51.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-62243](https://patchblox.com/security/data/cve/CVE-2026-62243.md) | High | netty-tcnative: TLS hostname verification bypass in Netty OpenSSL client path (bsc#1276455). | 7.5 | 0.0016 |  |
| [CVE-2026-93567](https://patchblox.com/security/data/cve/CVE-2026-93567.md) | Routine | netty-tcnative: HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled | n/a | 0.0289 |  |
| [CVE-2026-93569](https://patchblox.com/security/data/cve/CVE-2026-93569.md) | Routine | netty-tcnative: HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target | n/a | 0.0242 |  |
| [CVE-2026-93574](https://patchblox.com/security/data/cve/CVE-2026-93574.md) | Routine | netty-tcnative: HTTP request smuggling via post-digit whitespace in chunk-size parsing (bsc#1282374). | n/a | 0.0167 |  |
| [CVE-2026-93558](https://patchblox.com/security/data/cve/CVE-2026-93558.md) | Routine | netty-tcnative: Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service | n/a | 0.0122 |  |
| [CVE-2026-93573](https://patchblox.com/security/data/cve/CVE-2026-93573.md) | Routine | netty-tcnative: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282373). | n/a | 0.0108 |  |
| [CVE-2026-93579](https://patchblox.com/security/data/cve/CVE-2026-93579.md) | Routine | netty-tcnative: HTTP/2 header field values are not validated by default (bsc#1282378). | n/a | 0.0108 |  |
| [CVE-2026-93568](https://patchblox.com/security/data/cve/CVE-2026-93568.md) | Routine | netty-tcnative: HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests (bsc#1282370). | n/a | 0.0108 |  |
| [CVE-2026-93564](https://patchblox.com/security/data/cve/CVE-2026-93564.md) | Routine | netty-tcnative: HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (bsc#1282363). | n/a | 0.0106 |  |
| [CVE-2026-93488](https://patchblox.com/security/data/cve/CVE-2026-93488.md) | Routine | netty-tcnative: Denial of Service via unbounded concurrent SPDY streams (bsc#1282084). | n/a | 0.0096 |  |
| [CVE-2026-93491](https://patchblox.com/security/data/cve/CVE-2026-93491.md) | Routine | netty-tcnative: Denial of Service via unbounded HttpServerCodec HTTP/1.1 pipeline queue (bsc#1282085). | n/a | 0.0088 |  |
| [CVE-2026-93565](https://patchblox.com/security/data/cve/CVE-2026-93565.md) | Routine | netty-tcnative: RtspDecoder Method-Token Smuggling via Trailing Control Byte (bsc#1282364). | n/a | 0.0087 |  |
| [CVE-2026-93566](https://patchblox.com/security/data/cve/CVE-2026-93566.md) | Routine | netty-tcnative: HTTP Request Smuggling due to control characters in the chunk-size line (bsc#1282366). | n/a | 0.0058 |  |
| [CVE-2026-93562](https://patchblox.com/security/data/cve/CVE-2026-93562.md) | Routine | netty-tcnative: Incomplete validation of malformed Transfer-Encoding allows HTTP request smuggling (bsc#1282362). | n/a | 0.0049 |  |
| [CVE-2026-93492](https://patchblox.com/security/data/cve/CVE-2026-93492.md) | Routine | netty-tcnative: HTTP/2 HpackEncoder DoS with large table size (bsc#1282132). | n/a | 0.0048 |  |
| [CVE-2026-93494](https://patchblox.com/security/data/cve/CVE-2026-93494.md) | Routine | netty-tcnative: ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated (bsc#1282506). | n/a | 0.0041 |  |
| [CVE-2026-93560](https://patchblox.com/security/data/cve/CVE-2026-93560.md) | Routine | netty-tcnative: STOMP codec content-length long-to-int truncation causes infinite decode loop DoS (bsc#1282141). | n/a | 0.0041 |  |
| [CVE-2026-93575](https://patchblox.com/security/data/cve/CVE-2026-93575.md) | Routine | netty-tcnative: missing validations in the `MqttDecoder` can lead to excessive resource consumption and a DoS | n/a | 0.0039 |  |
| [CVE-2026-75596](https://patchblox.com/security/data/cve/CVE-2026-75596.md) | Routine | netty-tcnative: fragmented `ClientHello`records can trigger quadratic pre-handshake reassembly in default SNI parsing | n/a | 0.0037 |  |
| [CVE-2026-59902](https://patchblox.com/security/data/cve/CVE-2026-59902.md) | Routine | netty-tcnative: Netty: Memory Exhaustion in SctpMessageCompletionHandler (bsc#1275501). | n/a | 0.0037 |  |
| [CVE-2026-93572](https://patchblox.com/security/data/cve/CVE-2026-93572.md) | Routine | netty-tcnative: multiplication of patched preallocation limits in `RedisArrayAggregator` nested RESP headers can lead | n/a | 0.0034 |  |
| [CVE-2026-93563](https://patchblox.com/security/data/cve/CVE-2026-93563.md) | Routine | netty-tcnative: unbounded multi-line response accumulation in `SmtpResponseDecoder` leads to memory exhaustion and a | n/a | 0.0033 |  |
| [CVE-2026-59903](https://patchblox.com/security/data/cve/CVE-2026-59903.md) | Routine | netty-tcnative: Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite | 6.5 | 0.0032 |  |
| [CVE-2026-75595](https://patchblox.com/security/data/cve/CVE-2026-75595.md) | Routine | netty-tcnative: fragmented TLS `ClientHello` causes fallback to default `SslContext` and allows for SNI routing and | n/a | 0.0032 |  |
| [CVE-2026-89044](https://patchblox.com/security/data/cve/CVE-2026-89044.md) | Routine | netty-tcnative: HTTP request smuggling in Netty via improper validation of final Transfer-Encoding coding | n/a | 0.0028 |  |
| [CVE-2026-93576](https://patchblox.com/security/data/cve/CVE-2026-93576.md) | Routine | netty-tcnative: netty-codec-smtp -- SMTP command-name field is not CRLF-validated (bsc#1282507). | n/a | 0.0027 |  |
| [CVE-2026-62380](https://patchblox.com/security/data/cve/CVE-2026-62380.md) | Routine | netty-tcnative: null byte and CRLF injection in Socks4ClientEncoder and Socks5ClientEncoder (bsc#1276456). | n/a | 0.0025 |  |
| [CVE-2026-93578](https://patchblox.com/security/data/cve/CVE-2026-93578.md) | Routine | netty-tcnative: missing Extended Key Usage (EKU) check in OCSP client allows certificate revocation bypass | n/a | 0.0023 |  |
| [CVE-2026-93493](https://patchblox.com/security/data/cve/CVE-2026-93493.md) | Routine | netty-tcnative: missing `nextUpdate` field in OCSP responses leads to silent validation bypass (bsc#1281431). | n/a | 0.0022 |  |
| [CVE-2026-76816](https://patchblox.com/security/data/cve/CVE-2026-76816.md) | Routine | netty-tcnative: missing input validation in `MqttEncoder` allows for null-byte injection, topic hijacking, and ACL | n/a | 0.0017 |  |

---

Data as of 2026-11-11T19:49:26Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.