Red Hat Build Of Apicurio Registry 3 vulnerabilities

31 CVEs affecting Red Hat Build Of Apicurio Registry 3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-94449, published 2026-09-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-93567, published 2026-09-18. High severity, CVSS 7.5. EPSS: 2.6% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for…
CVE-2026-93569, published 2026-09-18. High severity, CVSS 8.2. EPSS: 2.2% chance of exploitation in the next 30 days. A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form…
CVE-2026-93574, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit…
CVE-2026-93558, published 2026-09-18. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the…
CVE-2026-40984, published 2026-06-09. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Affected versions: micrometer-core 1.16.0 through 1.16.5;…
CVE-2025-2240, published 2025-03-12. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when calling the metrics URI. Every call creates…
CVE-2026-5598, published 2026-04-15. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Covert timing channel vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA core on all (core modules). This vulnerability is associated with program files FrodoEngine.Java. This issue…
CVE-2026-93568, published 2026-09-18. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly…
CVE-2026-93564, published 2026-09-18. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead…
CVE-2026-93579, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due…

Latest

CVE-2026-94449, published 2026-09-21. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices. The issue occurs when using the…
CVE-2026-93562, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP…
CVE-2026-93432, published 2026-09-18. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard…
CVE-2026-93573, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple…
CVE-2026-93566, published 2026-09-18. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended…