漏洞公告

n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Netty: STOMP CONNECT Frame Header Injection in Netty

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

Netty: TOCTOU in OcspServerCertificateValidator

Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling

Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

Netty: Security Control Bypass via CORS Short-Circuit Failure

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion

Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

Netty SPDY SETTINGS frame count materializes unbounded settings map

Dompdf: File existence oracle via font-face stylesheet declaration