Red Hat Amq Clients vulnerabilities

15 CVEs affecting Red Hat Amq Clients, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93574, published 2026-09-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-93574, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit…
CVE-2026-93558, published 2026-09-18. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the…
CVE-2026-40984, published 2026-06-09. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5;…
CVE-2026-5598, published 2026-04-15. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue…
CVE-2026-93573, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple…
CVE-2026-3505, published 2026-04-15. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is…
CVE-2026-40983, published 2026-06-09. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition. Affected versions: Micrometer 1.16.0 through 1.16.5; 1.15.0…
CVE-2026-93488, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides…
CVE-2026-93565, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote…
CVE-2026-93491, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This…

Latest

CVE-2026-93562, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP…
CVE-2026-93566, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended…
CVE-2026-57915, published 2026-06-26. High severity, CVSS 7.3. EPSS: 0.5% chance of exploitation in the next 30 days. It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which…