{"id":"CVE-2026-44891","summary":"Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder","details":"Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.","aliases":["GHSA-vhch-2wf3-m8rp"],"modified":"2026-07-22T08:28:20.289567Z","published":"2026-07-17T20:16:24.486Z","related":["CGA-g7vr-ggr6-68xr"],"database_specific":{"cwe_ids":["CWE-400","CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44891.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.1.136.Final"},{"type":"WEB","url":"https://github.com/netty/netty/releases/tag/netty-4.2.16.Final"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44891.json"},{"type":"ADVISORY","url":"https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44891"},{"type":"FIX","url":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"type":"FIX","url":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"type":"FIX","url":"https://github.com/netty/netty/pull/17063"},{"type":"FIX","url":"https://github.com/netty/netty/pull/17065"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/netty/netty","events":[{"introduced":"0"},{"introduced":"09e64d259c99be8b5b2a471a78f11e65eb82598a"},{"fixed":"fca0764703b3bb59c6e6dc5d29c6d9710d35c0e6"},{"fixed":"3703d79669ee024f6483c9d8697ac58ba546df33"},{"fixed":"5b68c61f37aa4a3045cba624cbea239655c9003b"},{"fixed":"bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"4.1.136.Final"},{"introduced":"4.2.0.Final"},{"fixed":"4.2.16.Final"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["netty-4.1.135.Final","netty-4.2.15.Final","netty-4.1.134.Final","netty-4.2.14.Final","netty-4.1.133.Final","netty-4.2.13.Final","netty-4.2.12.Final","netty-4.1.132.Final","netty-4.2.11.Final","netty-4.1.131.Final","netty-4.2.10.Final","netty-4.2.9.Final","netty-4.1.130.Final","netty-4.2.8.Final","netty-4.1.129.Final","netty-4.1.128.Final","netty-4.2.7.Final","netty-4.2.6.Final","netty-4.1.127.Final","netty-4.2.5.Final","netty-4.1.126.Final","netty-4.1.125.Final","netty-4.2.4.Final","netty-4.1.124.Final","netty-4.1.123.Final","netty-4.2.3.Final","netty-4.2.2.Final","netty-4.1.122.Final","netty-4.2.1.Final","netty-4.1.121.Final","netty-4.1.120.Final","netty-4.2.0.Final","netty-4.1.119.Final","netty-4.1.118.Final","netty-4.1.117.Final","netty-4.1.116.Final","netty-4.1.115.Final","netty-4.1.114.Final","netty-4.1.113.Final","netty-4.1.112.Final","netty-4.1.111.Final","netty-4.1.110.Final","netty-4.1.109.Final","netty-4.1.108.Final","netty-4.1.107.Final","netty-4.1.106.Final","netty-4.1.105.Final","netty-4.1.104.Final","netty-4.1.103.Final","netty-4.1.102.Final","netty-4.1.101.Final","netty-4.1.100.Final","netty-4.1.99.Final","netty-4.1.98.Final","netty-4.1.97.Final","netty-4.1.96.Final","netty-4.1.95.Final","netty-4.1.94.Final","netty-4.1.93.Final","netty-4.1.92.Final","netty-4.1.91.Final","netty-4.1.90.Final","netty-4.1.89.Final","netty-4.1.88.Final","netty-4.1.87.Final","netty-4.1.86.Final","netty-4.1.85.Final","netty-4.1.84.Final","netty-4.1.83.Final","netty-4.1.82.Final","netty-4.1.81.Final","netty-4.1.80.Final","netty-4.1.79.Final","netty-4.1.78.Final","netty-4.1.77.Final","netty-4.1.76.Final","netty-4.1.75.Final","netty-4.1.74.Final","netty-4.1.73.Final","netty-4.1.72.Final","netty-4.1.71.Final","netty-4.1.70.Final","netty-4.1.69.Final","netty-4.1.68.Final","netty-4.1.67.Final","netty-4.1.66.Final","netty-4.1.65.Final","netty-4.1.64.Final","netty-4.1.63.Final","netty-4.1.62.Final","netty-4.1.61.Final","netty-4.1.60.Final","netty-4.1.59.Final","netty-4.1.58.Final","netty-4.1.57.Final","netty-4.1.56.Final","netty-4.1.55.Final","netty-4.1.54.Final","netty-4.1.53.Final","netty-4.1.52.Final","netty-4.1.51.Final","netty-4.1.50.Final","netty-4.1.49.Final","netty-4.1.48.Final","netty-4.1.47.Final","netty-4.1.46.Final","netty-4.1.45.Final","netty-4.1.44.Final","netty-4.1.43.Final","netty-4.1.42.Final","netty-4.1.41.Final","netty-4.1.40.Final","netty-4.1.39.Final","netty-4.1.38.Final","netty-4.1.37.Final","netty-4.1.36.Final","netty-4.1.35.Final","netty-4.1.34.Final","netty-4.1.33.Final","netty-4.1.32.Final","netty-4.1.31.Final","netty-4.1.30.Final","netty-4.1.29.Final","netty-4.1.28.Final","netty-4.1.27.Final","netty-4.1.26.Final","netty-4.1.25.Final","netty-4.1.24.Final","netty-4.1.23.Final","netty-4.1.22.Final","netty-4.1.21.Final","netty-4.1.20.Final","netty-4.1.19.Final","netty-4.1.18.Final","netty-4.1.17.Final","netty-4.1.16.Final","netty-4.1.15.Final","netty-4.1.14.Final","netty-4.1.13.Final","netty-4.1.12.Final","netty-4.1.11.Final","netty-4.1.10.Final","netty-4.1.9.Final","netty-4.1.8.Final","netty-4.1.7.Final","netty-4.1.6.Final","netty-4.1.5.Final","netty-4.1.4.Final","netty-4.1.3.Final","netty-4.1.2.Final","netty-4.1.1.Final","netty-4.1.0.Final","netty-4.1.0.CR7","netty-4.1.0.CR6","netty-4.1.0.CR5","netty-4.1.0.CR4","netty-4.1.0.CR3","netty-4.1.0.CR2","netty-4.1.0.CR1","netty-4.1.0.Beta8","netty-4.1.0.Beta7","netty-4.1.0.Beta6","netty-4.1.0.Beta5","netty-4.1.0.Beta4","netty-4.1.0.Beta3","netty-4.1.0.Beta2","netty-4.1.0.Beta1","netty-4.0.15.Final","netty-4.0.14.Final","netty-4.0.14.Beta1","netty-4.0.13.Final","netty-4.0.12.Final","netty-4.0.11.Final","netty-4.0.10.Final","netty-4.0.8.Final","netty-4.0.7.Final","netty-4.0.6.Final","netty-4.0.5.Final","netty-4.0.4.Final","netty-4.0.3.Final","netty-4.0.2.Final","netty-4.0.1.Final","netty-4.0.0.Final","netty-4.0.0.CR9","netty-4.0.0.CR8","netty-4.0.0.CR7","netty-4.0.0.CR5","netty-4.0.0.CR4","netty-4.0.0.CR3","netty-4.0.0.CR2","netty-4.0.0.CR1","netty-4.0.0.Beta3","netty-4.0.0.Beta2","netty-4.0.0.Beta1","netty-4.0.0.Alpha8","netty-4.0.0.Alpha7","netty-4.0.0.Alpha6","netty-4.0.0.Alpha5","netty-4.0.0.Alpha4","netty-4.0.0.Alpha3","netty-4.0.0.Alpha2","netty-4.0.0.Alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44891.json","vanir_signatures_modified":"2026-07-22T08:28:20Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-compression/src/main/java/io/netty/handler/codec/compression/Bzip2BlockDecompressor.java"},"deprecated":false,"digest":{"line_hashes":["120636894138568611417665334976744298814","231663183013581773918805076445939278113","65728032641867946651785835381755137609","221632879600518765062448949766145744292"],"threshold":0.9},"id":"CVE-2026-44891-00c98568"},{"deprecated":false,"digest":{"function_hash":"37240048901434324545494198502901448906","length":475},"id":"CVE-2026-44891-01a561b1","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec/src/main/java/io/netty/handler/codec/compression/Bzip2BlockDecompressor.java","function":"read"}},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspHttpHandler.java","function":"exceptionCaught"},"deprecated":false,"digest":{"function_hash":"77256901146827360824484640477475715069","length":86},"id":"CVE-2026-44891-04c9e4a5","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-44891-063d85ef","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"function":"setFilename","file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/MemoryFileUpload.java"},"deprecated":false,"digest":{"function_hash":"109888083554817988562479215027287151321","length":96}},{"deprecated":false,"digest":{"length":473,"function_hash":"249912671355718854669734932938515923365"},"id":"CVE-2026-44891-08714dd4","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-stomp/src/test/java/io/netty/handler/codec/stomp/StompSubframeEncoderTest.java","function":"testNotEscapeStompHeadersForConnectCommand"}},{"deprecated":false,"digest":{"function_hash":"126638612711200981758094771479557284055","length":306},"id":"CVE-2026-44891-09dce763","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3ServerConnectionHandler.java","function":"Http3ServerConnectionHandler"}},{"target":{"file":"codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessageDecoder.java"},"deprecated":false,"digest":{"line_hashes":["279713800493940188721478944624914390140","223992255661392215926648371556122318670","135372313935320011330038135544937546250","328938700747206466182084885385299163744"],"threshold":0.9},"id":"CVE-2026-44891-0bbd1983","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/test/java/io/netty/handler/codec/http3/Http3FrameCodecTest.java","function":"initChannel"},"deprecated":false,"digest":{"function_hash":"182237550411304793801690690075970966373","length":341},"id":"CVE-2026-44891-0c5bdbed"},{"deprecated":false,"digest":{"line_hashes":["47122418429269028864305264106012076829","284251912859526340174123699537992314940","160411447848638309849369772097487154878","312873797622959882686218719339700860481","188379642562150670200384623396524931150","52093842242912033257587973218645176202","282782900619275780217173386508570920154","179532008290851251345595845801204454025","82723766450067651198591237214014740687","151864454814103995933962176687890499135","5952154511356883982177322282335396546"],"threshold":0.9},"id":"CVE-2026-44891-0c6579ac","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3ServerConnectionHandler.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/DiskFileUpload.java","function":"setFilename"},"deprecated":false,"digest":{"function_hash":"109888083554817988562479215027287151321","length":96},"id":"CVE-2026-44891-0cd5e63f"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java"},"deprecated":false,"digest":{"line_hashes":["320806806550674732028211844957798520210","190711259418488859151705856982185519946","40988646246908169270622596568547602459","178706763715060271344942711485006812441","217128450400286329523067573549556780935","163321098785654711277613671154013741862","116543323493668684840438152959966355785","314290275408126691495858304680249369747","210625495697437445527444585650503633847","163529220398439374285659324093620468204","240484561326370812979594440356692722432","37560835342479990086963836372925584401","75677433386161800134633019629943161450","113288905901856213136472137500769169375","58097051837636187984765689123320564669","163993406421282438060771717787043522798","227969836372584186705675248845497594873","38044790720616066487232267203651220114","306195453208815660459111540564041455909","52186497845284313153154135567748814990","228048871323674709010913896263197763684","245618107537130521762809742542770653643","175816424572933745928040402669909564138","293207869162228013358644318103651969392","252295007112226392396784237227959992237","331450265577643775425887136946579793174","110954995215833540033207126019749201480","257582701017251763685086933023665567452","254664894396716986499865816387509999280","335905733194747697429556302413647893656","138096167655618098180071181194675453638","35952787621064319778771278996351871625","215895075754588473378201177045153975767","127207673452762906211617431972815904085","127492926156995909706614872104250420029"],"threshold":0.9},"id":"CVE-2026-44891-0cf74b76"},{"deprecated":false,"digest":{"function_hash":"23590839795514765399826094902659060377","length":3221},"id":"CVE-2026-44891-0d6e5606","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3FrameCodec.java","function":"decodeFrame"}},{"digest":{"function_hash":"76062077272985545312107626768023993004","length":301},"id":"CVE-2026-44891-0e0877da","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyFrameDecoder.java","function":"SpdyFrameDecoder"},"deprecated":false},{"digest":{"function_hash":"123816676250845503850654196242282238637","length":812},"id":"CVE-2026-44891-0ea7eb1c","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java","function":"encodeHeaders"},"deprecated":false},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHeaderBlockZlibDecoder.java","function":"SpdyHeaderBlockZlibDecoder"},"deprecated":false,"digest":{"function_hash":"329843847068552324655743178063563805308","length":68},"id":"CVE-2026-44891-103c837c","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/test/java/io/netty/handler/ssl/ocsp/OcspClientTest.java","function":"simpleOcspQueryTest"},"deprecated":false,"digest":{"function_hash":"74595309676895981686441715715701824771","length":571},"id":"CVE-2026-44891-136cb385","signature_type":"Function","signature_version":"v1"},{"target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/MemoryFileUpload.java"},"deprecated":false,"digest":{"line_hashes":["148995502217930445083416085245073095762","151137883575827367753396990396317711974","122827585180141696600914897933171190094","214597371553343991233996528047656947661"],"threshold":0.9},"id":"CVE-2026-44891-1428e514","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3ConnectionHandler.java","function":"Http3ConnectionHandler"},"deprecated":false,"digest":{"function_hash":"25890922406102302296168406085370443801","length":1373},"id":"CVE-2026-44891-1560fade","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"id":"CVE-2026-44891-17df53ff","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3ConnectionHandler.java","function":"Http3ConnectionHandler"},"deprecated":false,"digest":{"function_hash":"301742561022809608916527423747754307266","length":206}},{"deprecated":false,"digest":{"line_hashes":["85269044829674307358000079209799629337","79336017118920939603572992123962365933","304403807524013726629156840792486146913"],"threshold":0.9},"id":"CVE-2026-44891-18144b4c","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/FileUploadUtil.java"}},{"deprecated":false,"digest":{"function_hash":"158286349469036580774923563317271823577","length":1533},"id":"CVE-2026-44891-194d67b5","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker07.java","function":"newHandshakeResponse"}},{"digest":{"function_hash":"165504389244669948793999633129656906256","length":333},"id":"CVE-2026-44891-1c5c4c99","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3FrameCodec.java","function":"newFactory"},"deprecated":false},{"digest":{"function_hash":"189445986669014090366835749553448882144","length":93},"id":"CVE-2026-44891-1d7e0ef2","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspHttpHandler.java","function":"OcspHttpHandler"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["279713800493940188721478944624914390140","223992255661392215926648371556122318670","135372313935320011330038135544937546250","328938700747206466182084885385299163744"],"threshold":0.9},"id":"CVE-2026-44891-1da1b843","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessageDecoder.java"}},{"target":{"file":"codec-dns/src/main/java/io/netty/handler/codec/dns/DnsCodecUtil.java","function":"decompressDomainName"},"deprecated":false,"digest":{"function_hash":"299521081110227015211366036970650967762","length":180},"id":"CVE-2026-44891-1e85278e","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"deprecated":false,"digest":{"length":1489,"function_hash":"222798997432167409900273945058832022698"},"id":"CVE-2026-44891-1f3d22e9","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"query"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java"},"deprecated":false,"digest":{"line_hashes":["160856727183441628202072251565823803095","105749132124367098035389648295487021464","118185513643260554908741716036402767856","83708985391929940133118263479536866566","311492259179391967641018178727592688967","89368361429369981390973534115563368581","77193987120142002508296462090157492410","139851497706414496087195643402254450167","39662224170809360398344969026899457523","178816243284968540841210495673910482227","176287640514349733141158040386906513598","303665514185620789986397669285487412138","297739096657727811260082502255166650770","136572713293192237495034777693097852011","158745396765987017925033669780165034429","240980895617077683768741812290916815183","30015959068743022629301560091843739396","239637474864958538866950879400282099672","55627591212767070003742815130074663843","33545055825566805281471658140956238643","1599870427874156370699958205848303850","241199099516041511318134287525761930307","246871629290293414168368597517471460303","260607150530821294586258494351141961373","74360914599811584596350433122742324491","328723346762203766422198579327933561424","268658860689973553848984173042110766991","222513809318578456911917473746657710374","126955523728942222450288430081022540808","98673459035885338343719438331613830778","336958556695484310824152553137121440588","329954361153472128459209824337947753109","238002347403422063848421268354161563879","205601945213753446539650461657182213303","2450118565105161870620091343280108277","224884316399012034779596116030132226295","56237681584886468665470618506553056075"],"threshold":0.9},"id":"CVE-2026-44891-1f5c1bfe"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"function":"testNotEscapeStompHeadersForConnectedCommand","file":"codec-stomp/src/test/java/io/netty/handler/codec/stomp/StompSubframeEncoderTest.java"},"deprecated":false,"digest":{"function_hash":"327225770290667286573364391638073645393","length":477},"id":"CVE-2026-44891-212868aa"},{"digest":{"line_hashes":["148995502217930445083416085245073095762","151137883575827367753396990396317711974","122827585180141696600914897933171190094","214597371553343991233996528047656947661"],"threshold":0.9},"id":"CVE-2026-44891-2282852d","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/DiskFileUpload.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"26228862255270855970694047597303872456","length":566},"id":"CVE-2026-44891-232a66f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"function":"customSensitivityDetectorIsForwardedToQpackEncoder","file":"codec-http3/src/test/java/io/netty/handler/codec/http3/Http3ServerConnectionHandlerTest.java"}},{"deprecated":false,"digest":{"line_hashes":["213001641769356484048488676129118987874","21925855898804535777340715217688183010","75743800141268020976889072350512137694","242979901231947713000954909566945864167","230344429068811301568411935303419277472","187273214625919887085102085762053239459","213029616262645006972529969959552494224"],"threshold":0.9},"id":"CVE-2026-44891-2347e3d9","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-haproxy/src/test/java/io/netty/handler/codec/haproxy/HaProxyMessageEncoderTest.java"}},{"id":"CVE-2026-44891-24340ac0","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java","function":"encode"},"deprecated":false,"digest":{"function_hash":"19711077448101257361666803412315960086","length":589}},{"deprecated":false,"digest":{"function_hash":"329843847068552324655743178063563805308","length":68},"id":"CVE-2026-44891-256d7b53","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHeaderBlockZlibDecoder.java","function":"SpdyHeaderBlockZlibDecoder"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHttpDecoder.java"},"deprecated":false,"digest":{"line_hashes":["5099508505793785653380089081581068536","163662929399825473877945283499901972806","302538080194839169729435064056900395891","319200107927616819850709943057179982538","43347823511688047597091478480439157115","116811847451234772118810671735939643387","74845773030462651942008022278501128066","259826453677426941715440281554658434257","252870990245997068246687568311139721053","61009422835929975013692921870850500763","248752210096752933307838042319090288211","132372023481088466617455292920497561571","33840657080523454048127231265222181801","202670965636704213025732033147592042500","177756180006400759159895209647194527591","226952726811222727719171056050998915589","75008778305216660045216971615803594038","120643515059325132854117014998925412487","4583944895215471139857130207304728926","248752210096752933307838042319090288211","132372023481088466617455292920497561571","53323777171816876778592451507868772777","136718777534352786561795281262168674351","302694118546143346491743206530864634740","336047544932810775290743421984487452477","181000531097400470097550853733881384618","185447235944833730731193359710110182343","329446678472034164729031305713172739646","135328746054757016270622467391750950709","242005591098446160139116110002451261220","61009422835929975013692921870850500763","224979359281428934190320932180134208843","204240542162453174121468703681820689074","76910762439555311220727809737337980688","323295700588174768260571269689809546906","119920077526379890341853682067536892639","190487902445456996498177885397377561030","338164634005685856358413396982407852736","151350667349605328569332833393526081844","270535196956921532314969752251337703153","231211174035521815968284018717444982535","186172227993476429643357434480571283019","286988781147878862609814022268020183575","205821388922182153553131724719326476265","326787349086267178625377061176436320173","217418732311405636634270375225873923672","65272979485579786060392579022637174848","187207502571152124816540943248686387077","192300241438320673977188445573164828022","254306052096301922043771841888580666654","286988781147878862609814022268020183575","205821388922182153553131724719326476265","127843818370887171671969721238849627746","235995019467478501180137454588185710326","117071517653609957361251813385265022964","175579248799337524330234288222511777657","282137381728079872100499511468857515693","18281053755418136821172731134271402650","300966519305956072370909981755834480875","258322609877250075815976079330610512897","73861345486618890304309377330007766615","236823114111872765815294766618594221869","165185295969821521892512429778818163706","125463676817338867285144803620878917783","102623118576998421707034793967272914635","268083582568518690085476447951758566051","307065726985811218688680347275929314346","135997585684856397036452354389395434119"],"threshold":0.9},"id":"CVE-2026-44891-2575d92b"},{"id":"CVE-2026-44891-2679510a","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/HttpContentEncoderTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["172013050884991683488590728540336593142","335657993299234137396508154959648311623","142718830088658019156516157260030237716","206535563861374960247829131538297890013","158369500946582605747179361914195286690","241472630589226420242837396792321853404","240563036243152161285851997338211957996","124021888710218370532958828180321821647","271136652821827806183711847625915871303","260390810753422853267386379277568938405","300251567441907825130842825027073774440"]}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"Initializer"},"deprecated":false,"digest":{"function_hash":"54946750876090677008110994659516782338","length":84},"id":"CVE-2026-44891-27cd337a","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3ServerConnectionHandler.java","function":"Http3ServerConnectionHandler"},"deprecated":false,"digest":{"function_hash":"301742561022809608916527423747754307266","length":206},"id":"CVE-2026-44891-27ff7935","signature_type":"Function"},{"target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java"},"deprecated":false,"digest":{"line_hashes":["270762246741101941642542572106199202165","44240978820938050603617821743305127713","180327344206548645876772916274966899843","211735656644421554895276610523137416957"],"threshold":0.9},"id":"CVE-2026-44891-28fdf2ab","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"function":"HAProxyMessage","file":"codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java"},"deprecated":false,"digest":{"function_hash":"10795440751191988041233867027603607931","length":673},"id":"CVE-2026-44891-2d20c7f7","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["333821532415311932941979621381713229581","236840159726956420120343719179126065215","309655443383011648246724092834013324773"],"threshold":0.9},"id":"CVE-2026-44891-2d22c3f7","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/HttpConstants.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-xml/src/main/java/io/netty/handler/codec/xml/XmlDecoder.java"},"deprecated":false,"digest":{"line_hashes":["156752510038407923441450894742669625510","55915757974275319165450151800440635830","166836323056633657946759736202737049630","307799663942416250575839223636423233484","163575489982936682653802420913792867427","41003518262735134244896737105600871815","12887326223628438565177135006897777278"],"threshold":0.9},"id":"CVE-2026-44891-2d2cece8"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["333821532415311932941979621381713229581","236840159726956420120343719179126065215","309655443383011648246724092834013324773"]},"id":"CVE-2026-44891-2deb15e9","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/HttpConstants.java"}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/test/java/io/netty/handler/codec/http3/Http3FrameCodecTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"107782549255214386641748452500015175382","length":1945},"id":"CVE-2026-44891-2e99a6fb","signature_type":"Function"},{"id":"CVE-2026-44891-2f152542","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/test/java/io/netty/handler/ssl/ocsp/OcspClientTest.java"},"deprecated":false,"digest":{"line_hashes":["281487314526881440024969972129090559569","238652767711374829000719752234952689767","156669762352083429314676642995079278207","329499987968505534476817494087386955836","74543458848902162164595908899608303475"],"threshold":0.9}},{"id":"CVE-2026-44891-30be0d77","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http2/src/main/java/io/netty/handler/codec/http2/HttpConversionUtil.java","function":"translateHeaders"},"deprecated":false,"digest":{"length":900,"function_hash":"20347725153493602998519738037936451189"}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-dns/src/main/java/io/netty/handler/codec/dns/DefaultDnsRecordDecoder.java","function":"decodeRecord"},"deprecated":false,"digest":{"function_hash":"325156945155766697620025912436547709183","length":1142},"id":"CVE-2026-44891-31bbe60c","signature_type":"Function"},{"target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHttpDecoder.java"},"deprecated":false,"digest":{"line_hashes":["5099508505793785653380089081581068536","163662929399825473877945283499901972806","302538080194839169729435064056900395891","319200107927616819850709943057179982538","43347823511688047597091478480439157115","116811847451234772118810671735939643387","74845773030462651942008022278501128066","259826453677426941715440281554658434257","252870990245997068246687568311139721053","61009422835929975013692921870850500763","248752210096752933307838042319090288211","132372023481088466617455292920497561571","33840657080523454048127231265222181801","202670965636704213025732033147592042500","177756180006400759159895209647194527591","226952726811222727719171056050998915589","75008778305216660045216971615803594038","120643515059325132854117014998925412487","4583944895215471139857130207304728926","248752210096752933307838042319090288211","132372023481088466617455292920497561571","53323777171816876778592451507868772777","136718777534352786561795281262168674351","302694118546143346491743206530864634740","336047544932810775290743421984487452477","181000531097400470097550853733881384618","185447235944833730731193359710110182343","329446678472034164729031305713172739646","135328746054757016270622467391750950709","242005591098446160139116110002451261220","61009422835929975013692921870850500763","224979359281428934190320932180134208843","204240542162453174121468703681820689074","76910762439555311220727809737337980688","323295700588174768260571269689809546906","119920077526379890341853682067536892639","190487902445456996498177885397377561030","338164634005685856358413396982407852736","151350667349605328569332833393526081844","270535196956921532314969752251337703153","231211174035521815968284018717444982535","186172227993476429643357434480571283019","286988781147878862609814022268020183575","205821388922182153553131724719326476265","326787349086267178625377061176436320173","217418732311405636634270375225873923672","65272979485579786060392579022637174848","187207502571152124816540943248686387077","192300241438320673977188445573164828022","254306052096301922043771841888580666654","286988781147878862609814022268020183575","205821388922182153553131724719326476265","127843818370887171671969721238849627746","235995019467478501180137454588185710326","117071517653609957361251813385265022964","175579248799337524330234288222511777657","282137381728079872100499511468857515693","18281053755418136821172731134271402650","300966519305956072370909981755834480875","258322609877250075815976079330610512897","73861345486618890304309377330007766615","236823114111872765815294766618594221869","165185295969821521892512429778818163706","125463676817338867285144803620878917783","102623118576998421707034793967272914635","268083582568518690085476447951758566051","307065726985811218688680347275929314346","135997585684856397036452354389395434119"],"threshold":0.9},"id":"CVE-2026-44891-320a27e0","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"deprecated":false,"digest":{"length":86,"function_hash":"77256901146827360824484640477475715069"},"id":"CVE-2026-44891-3222ef7b","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspHttpHandler.java","function":"exceptionCaught"}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyFrameDecoder.java"},"deprecated":false,"digest":{"line_hashes":["317604031820060118453154956993093684717","24873742710002895818134491604392062031","114076331002914605831157811091363512751","129155374381983620206647657666718803900","273934057914773020445401690645104830644","271096040010193221535560976200559268748","290639620904545869211648454889152674971","334256796902082616817282979901037794356","113722296319761634041515489835492615054","202905611593170866299233151191528269316","137368756049624756721723231633953444526","287141344036298448640388506882806594002","97538379800756998626675400391820040951","318814246010180669436408818179429798289","209841647201342990906907102603208796005","308887872369250698363447449227166337682"],"threshold":0.9},"id":"CVE-2026-44891-33b973a0","signature_type":"Line"},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http2/src/main/java/io/netty/handler/codec/http2/HttpConversionUtil.java","function":"translateHeaders"},"deprecated":false,"digest":{"function_hash":"20347725153493602998519738037936451189","length":900},"id":"CVE-2026-44891-341a107b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"codec-http2/src/test/java/io/netty/handler/codec/http2/HttpConversionUtilTest.java"},"deprecated":false,"digest":{"line_hashes":["16714536401088447436111609360693806903","125032373627195779714964835737054375337","96851361144117548187657929714803855685"],"threshold":0.9},"id":"CVE-2026-44891-34e63352","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"digest":{"line_hashes":["229776931096426289713632115934639778290","184335651301091282207059714137105758097","236810274921808555095747955503979749219","222755002395272721410369251519646209204","305034494851049054024830508380305909885","314040745707642223603463183650906034873","59386842982122553466228278194564029105","172427441018750910351734049962012148225","199624411135024056435848593434712708158","259261924834074305410729537921303601175","88345432068906474722769247251235229410","162181679510629652440429745757473670466","203670703248166197889417174373441153567"],"threshold":0.9},"id":"CVE-2026-44891-364ad6e4","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java"},"deprecated":false},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshakerTest.java"},"deprecated":false,"digest":{"line_hashes":["276113160309829117974824003364488810184","135980683857183404361006806776767282637","507981228172429656527024184285440560","270806507045708637137967600940037731815","17295407340861614269193684007444842369","152315126817788600715035560776443638804"],"threshold":0.9},"id":"CVE-2026-44891-36708ca5","signature_type":"Line","signature_version":"v1"},{"target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13Test.java","function":"testHandshakeExceptionWhenInvalidUpgradeHeader"},"deprecated":false,"digest":{"length":1054,"function_hash":"20226002739668651510770811029403108866"},"id":"CVE-2026-44891-37391ca6","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/MemoryFileUpload.java"},"deprecated":false,"digest":{"line_hashes":["148995502217930445083416085245073095762","151137883575827367753396990396317711974","122827585180141696600914897933171190094","214597371553343991233996528047656947661"],"threshold":0.9},"id":"CVE-2026-44891-380d437a","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"305535030871927154126669717026671942296","length":1046},"id":"CVE-2026-44891-38c08ab9","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"function":"testHandshakeExceptionWhenInvalidConnectionHeader","file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13Test.java"},"deprecated":false},{"digest":{"function_hash":"93858276672852509543204539026981621257","length":318},"id":"CVE-2026-44891-396cb5ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java","function":"getForOrigin"},"deprecated":false},{"id":"CVE-2026-44891-3987bdb7","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/HttpContentEncoder.java"},"deprecated":false,"digest":{"line_hashes":["283179859870524845797877371650239077067","293143580281501283944030300363274085592","178839704332000151183983533540151740283","181361359011210554692016855490415982252","75450897332370839171530547463842525218","185502155224820423619283371007335996806","186223448902923420743744364532043270681","131736501344004268176685384234166960121","37107057865595085469849483021709543208","182606988728277637093169144598888544372","92460093428818057124091083193825366805","270282705847449359243973034369359703311"],"threshold":0.9}},{"target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java","function":"StompSubframeDecoder"},"deprecated":false,"digest":{"function_hash":"155246494514114739496685541720103862788","length":92},"id":"CVE-2026-44891-39d220d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"deprecated":false,"digest":{"function_hash":"195190114642638539078426089425730004892","length":6469},"id":"CVE-2026-44891-3a91583a","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyFrameDecoder.java","function":"decode"}},{"digest":{"threshold":0.9,"line_hashes":["229776931096426289713632115934639778290","184335651301091282207059714137105758097","236810274921808555095747955503979749219","222755002395272721410369251519646209204","305034494851049054024830508380305909885","314040745707642223603463183650906034873","59386842982122553466228278194564029105","172427441018750910351734049962012148225","199624411135024056435848593434712708158","259261924834074305410729537921303601175","88345432068906474722769247251235229410","162181679510629652440429745757473670466","203670703248166197889417174373441153567"]},"id":"CVE-2026-44891-3bd7d140","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec/src/test/java/io/netty/handler/codec/compression/Bzip2DecoderTest.java"},"deprecated":false,"digest":{"line_hashes":["92307578025388777348656153027843725717","202016463117255771211198884405030283753","200002322802979857934563463776227725935","211739621856492752117528315763210616994","272814947343250035639939340202033124367","238639115832669564304637186337632408672","176615763682171961737415489928119070452","61257659008443162589687075419487494382","315071461160297541029213502906456347927","326969602072466906860174134051499186112"],"threshold":0.9},"id":"CVE-2026-44891-3c0596da"},{"target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java","function":"getForOrigin"},"deprecated":false,"digest":{"function_hash":"93858276672852509543204539026981621257","length":318},"id":"CVE-2026-44891-3e47982b","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java","function":"StompSubframeDecoder"},"deprecated":false,"digest":{"function_hash":"265019583742382382451102338062503837135","length":334},"id":"CVE-2026-44891-3f6f7b6b"},{"id":"CVE-2026-44891-404ee2b8","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"function":"validateResponse","file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java"},"deprecated":false,"digest":{"function_hash":"278949051441729616347092541160385134778","length":403}},{"digest":{"line_hashes":["148995502217930445083416085245073095762","151137883575827367753396990396317711974","122827585180141696600914897933171190094","214597371553343991233996528047656947661"],"threshold":0.9},"id":"CVE-2026-44891-40d5b25f","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/DiskFileUpload.java"},"deprecated":false},{"id":"CVE-2026-44891-40db099e","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/spdy/SpdyHeaderBlockZlibDecoderTest.java"},"deprecated":false,"digest":{"line_hashes":["300577177173333653220623478705162610804","334115406407850863177922300462689801030","219265018885931866228175740784706168804","102388623909325049630131000664888705330","179161482716674097018460997460540139581","296919889291562822503487588561948795398","274628771904830941483873610595637613241","216302050802671294652420443724034175946"],"threshold":0.9}},{"id":"CVE-2026-44891-437fe043","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java","function":"StompSubframeDecoder"},"deprecated":false,"digest":{"function_hash":"265019583742382382451102338062503837135","length":334}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-dns/src/main/java/io/netty/handler/codec/dns/DnsCodecUtil.java"},"deprecated":false,"digest":{"line_hashes":["27959559760793966902178019669445130160","292658081675404076645772265698203539455","64600387313959240170931702109936638782","39420768727777720589375927192115550958"],"threshold":0.9},"id":"CVE-2026-44891-44f07949"},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java"},"deprecated":false,"digest":{"line_hashes":["235036769015100095960476662614851768947","106432843125135978645536772495575421270","185181125721932247846926860451759832986","66555547424044998101488061467293134363","237931008944134959779715416113481894720","198286761853788273330334869439987826647"],"threshold":0.9},"id":"CVE-2026-44891-47fc38e9","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-redis/src/main/java/io/netty/handler/codec/redis/RedisArrayAggregator.java","function":"decodeRedisArrayHeader"},"deprecated":false,"digest":{"function_hash":"14450297343088225418659765307324861358","length":684},"id":"CVE-2026-44891-49570222","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"262016330598789818792568708104125130605","length":4465},"id":"CVE-2026-44891-4a3b5d60","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHttpDecoder.java","function":"decode"}},{"target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspServerCertificateValidator.java","function":"exceptionCaught"},"deprecated":false,"digest":{"function_hash":"318029928101993199939194693949693196607","length":86},"id":"CVE-2026-44891-4ab5dcc1","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspHttpHandler.java","function":"OcspHttpHandler"},"deprecated":false,"digest":{"function_hash":"116371785157251747062966964865428723305","length":119},"id":"CVE-2026-44891-4ad3cb57","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/cors/CorsHandlerTest.java"},"deprecated":false,"digest":{"line_hashes":["176776842045074526269533187815353173872","235025146080628010521672322610909598452","100826063227314915093477939577346625584"],"threshold":0.9},"id":"CVE-2026-44891-4b07bf4b","signature_type":"Line"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java","function":"encodeFullFrame"},"deprecated":false,"digest":{"length":293,"function_hash":"2876129745855369406358828415144086041"},"id":"CVE-2026-44891-4bfd925c"},{"target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java","function":"escape"},"deprecated":false,"digest":{"length":615,"function_hash":"154334759911960807374640596735255054145"},"id":"CVE-2026-44891-4c53f456","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"deprecated":false,"digest":{"line_hashes":["76571461240793360179205533572957495184","284526074985489190220706315212850108148","32679306466974974772639307458847741494","46432974478981562266833662746703085437","322761577482041636903947734541456912539","5261341792796232694396663218625177188","191301281738289231831709372761189177786","177771857949931981918452586780526911192","87753945271299953963873994276907119237","87942357236485403927753532389381431273"],"threshold":0.9},"id":"CVE-2026-44891-4d68c6bc","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-stomp/src/test/java/io/netty/handler/codec/stomp/StompSubframeDecoderTest.java"}},{"deprecated":false,"digest":{"function_hash":"305535030871927154126669717026671942296","length":1046},"id":"CVE-2026-44891-4e3afe15","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13Test.java","function":"testHandshakeExceptionWhenInvalidConnectionHeader"}},{"deprecated":false,"digest":{"function_hash":"283548877452382794032107879091356283655","length":1824},"id":"CVE-2026-44891-51d4a107","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"function":"query","file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-redis/src/main/java/io/netty/handler/codec/redis/RedisArrayAggregator.java"},"deprecated":false,"digest":{"line_hashes":["233546309237886414295345360674402568960","171048139463872279378169252331233610706","149156141487420180961330513075367916941","304506414543801421346313800571328420568","20494441483757075073987675444581146955","286509145826521364911866453390303402097","116026940602797325682588178723926501117","219593989683839262659567759506453760061","52886726899292340609675509739810954146","255593300683083263249028612033622205528","322547090658323602134070240751962696175","282539225339452086708875888010389487354","57917196876322009600265307306434346113","270911487146534097738850758326462207027","165861613173804328690858713425063512487","14953908664060733649241468777070547943"],"threshold":0.9},"id":"CVE-2026-44891-5207501e"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3ClientConnectionHandler.java"},"deprecated":false,"digest":{"line_hashes":["117428278433474497327601188626130715788","72221225393182540433232469939735998861","41887118011753979310130252686241662787","46281544856730418441096890634778486667","64070004163492907303014945235882899093","52093842242912033257587973218645176202","296851157837629169492229340817565533798","272740629148397783562277225523960390929","224990855008946161975281278055685585190","141291827786523215094852115445113445664","299114174578938615046255059713551823607"],"threshold":0.9},"id":"CVE-2026-44891-539dc0e8","signature_type":"Line"},{"target":{"file":"codec-http3/src/test/java/io/netty/handler/codec/http3/Http3ClientConnectionHandlerTest.java"},"deprecated":false,"digest":{"line_hashes":["170055936264544082404853063995526764050","186605038292069715914744467340475989017","72613191114831608813042862655425522073","324530711068603710117506324225260147457"],"threshold":0.9},"id":"CVE-2026-44891-53ffd69a","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-haproxy/src/test/java/io/netty/handler/codec/haproxy/HAProxyMessageDecoderTest.java"},"deprecated":false,"digest":{"line_hashes":["327029833501120662209868152744124089203","112835309588071539530671890227008312453","160200437653492181920062164065863339719"],"threshold":0.9},"id":"CVE-2026-44891-55eb8e94","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-44891-5629e1d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13.java"},"deprecated":false,"digest":{"line_hashes":["81392128422760144050255710414556984183","280584068852451031455010983275600918830","245995820009975659899714545244822257100","50348118516633030433397738805442135183","173388259662917107739710383479963073606","29365316359408955423358960315334961898","159722665820944141382882787371290953199","326710700057757774322767279688983325480"],"threshold":0.9}},{"target":{"file":"codec-dns/src/main/java/io/netty/handler/codec/dns/DefaultDnsRecordDecoder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["6824265245759376681920259781050386316","242498962665045566338481960659072215785","23162040932569393978586535154164415827","315744331822506146101998695239907614057","217912431069155449070796477345199034493","79336991594580389109891421564756054","296028145518921231660070789079175450226","302060337389211543317724635036410782228","308051361637886027886725330763733017724","246794346306455821634547109978533689082","312987364280858726404236213455474488208","235440393173817311278493945903941487556","289200999983206267863812043006504833111","264072080363553910515491799896025737978","147343901762383993578740675379460094672","19240966935348767001171731323886840368","124006299502011933802849989607028983058","281414852450730059361378931245325210899","20310700185611001647801606001754101580","66905211013575359036015406514975423914","269842649486392816948385443837445988299","44262056761219845075531251679578306509","48687507940012810143328438394770483671","51162542862627663918192777359230324524","215130032490703768744689897355611136303","3850095144291681241727786468222353354","108139682920200659433219967486450171661","256649143699176351579433102523926682174"]},"id":"CVE-2026-44891-5923f7ae","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"deprecated":false,"digest":{"line_hashes":["33419047885776515783743983592435706151","120352067145491294345958942702663811767","195818797374754609844615086972514488677","247323321822647248618564668415187530006","21691826279848268048300849622793650813","101984695432210075257641518475480681424","317781255596167820325798775006278530204","127082689337489543642677274013055816313","292583044569800847619459337837869792031","183589364534110556272182657624765380982","255086003830844110449252355105610040335","91928940405509196731075063814043644405","192181032577053251190207797028036804961","48164079053714244211083745838949487620","104974042836130463410037188845774637522","194688980860364871878859594915459210933","158359192135722756887480609457656277380","332420216311642706540591118767355728469","282874545055235556684328858654758179736","237765601347400524689911827606037631193","8468731914484715452809477093773189864","96342194362684967664383738751692710315","239076586194324360028936641072148277210","87838872839648455503607887512592903751","111577162655881404267918058199469813516","288952071575803718391675807969541225689","38679765214304975122307842729536669509","1607960469470282495260451809258625817","206675032356986279961516893343201605118","119029320071812693647455558113805398746","213412509357151740027271321817987126429"],"threshold":0.9},"id":"CVE-2026-44891-5a6e1bca","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspHttpHandler.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspServerCertificateValidator.java","function":"userEventTriggered"},"deprecated":false,"digest":{"function_hash":"267401578347488708583048205485149935132","length":1418},"id":"CVE-2026-44891-5bbba07b"},{"digest":{"function_hash":"30355876519965129833317156580072215067","length":693},"id":"CVE-2026-44891-5c29d1c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java","function":"decompress"},"deprecated":false},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java","function":"HeaderParser"},"deprecated":false,"digest":{"function_hash":"295499737833103450174922450294808749447","length":105},"id":"CVE-2026-44891-5f1e1849","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java","function":"parseHeader"},"deprecated":false,"digest":{"function_hash":"60411315538829935459783310606141971220","length":594},"id":"CVE-2026-44891-609f2ae0","signature_type":"Function"},{"digest":{"function_hash":"295499737833103450174922450294808749447","length":105},"id":"CVE-2026-44891-633a15c1","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java","function":"HeaderParser"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["71182898787560325904575462663348732975","31725542544301116871194913910836769902","119969337150663626253074767251113238685","953319363372630143895565562247547209","100576412687396084306690656408523478136","193413575491687030131197505763803258832","156583693553782734281191274112705186363","101619042600244975609347946208590640916","11487515226310945616873007193180975047","212842748404286486806449256439223642493","34897071272076691552994684567032794227","175260018271365571681451827948075556889","225185337519122960635489602770317770849","94986780315441369562137866404302887441","207962998271968566628011142009966132560","142523494755535006413896002794455595958","205265774584368246470108541273528435050","263817841364458406554844531418960615303","11970821231753901346001074558237101505","113095154244126861855663218711155537274","29869145088257743476336475470707580101","143964644511201814324611895192940982139","232376447983589061266806449656092459882","8114045057466992560835084040971164819","186019688949669095584151745537165851495","210700478774727959757071611761226998793","91873084729643273454256339117263672948","212772440809833043296380373328436780364","223353488557736518075373677120415057147","66230079586221602533683079108150885731","114641671995550306393521531847905324917","71179428326826029045817706683216244652","153353375495434710610253851917823297129","58488983811283973941484210296909501781","206117034240465364826256146151310545406","194707926360422607689528801370317046189","8162293371831705572939428653349368927","183357260775761942099293984048188123947","327278591048541102019645329859074323709","6898800398549896855269341333883757525","158674141349300890461151838700384750616","87235086650453125113395188138884819333","84974665120075111219826841759507257869","37790517393357006584372511962313062984","130500059856653084530475449883866959631","125152456607080617016006062770541033234","32844143060089022942922956695233771342","149538612318698413681345854363740716337","11855280900747258312590874216415383456","28468600491638739423634366526405451598","250888431761727825256773376285144795568","63685134680601053787986471866874062147","126790359920638380463435247528558048040","183166210601465775602117004606532348914","74006510139886820265090714436237173632","64952767840870759058168228249357253779","4149865153886428280753690619954987824","264664389131361404755327142345473798887","114247364668277063969160024795088680412","198946831123579435195332292348895700387","238531245921237845612995248667329427526","122067452584392437142744981873262641588","168282457349028579317539822704603859339","197616840944409057890547713444451384480","27537125801120894839956508210994654325"],"threshold":0.9},"id":"CVE-2026-44891-638884c2","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java"}},{"id":"CVE-2026-44891-63958c0b","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker00Test.java"},"deprecated":false,"digest":{"line_hashes":["132857200373237802621386637946607647113","61127478361417608997233252217306581854"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["74266644962816536446962297321223189604","301930874733366798286746926672462980331","39539511746329286156935312545147176033","220476366281893180134898027728468482540","2990444965863727127400438988476281308","307659593766027796344894026647493516039","15928223785990460031080493006365712181"],"threshold":0.9},"id":"CVE-2026-44891-66c8fd52","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/spdy/SpdyFrameDecoderTest.java"}},{"target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHeaderBlockZlibDecoder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["289589371407724941027865520138414194198","44180767926753992353896882624097923544","228324260497123778114866393953590614847","323344959370884306360969541162389141773","228827500599399636207857239704800201443","204242865643896690865120250583974877134","174653218091944314744909480991884923348","100911385523467371306475337172156079988","125972357147270616959444863392036292180","185576918399064693769245320862080253814","73279680051815879668628323951740046864","281269823248768859485245749207012322299","259358861207724151538138303042909838802","80011698943881026307423884911622147496","80746681379275779146593596149555586330"]},"id":"CVE-2026-44891-670aa424","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"function":"testHandshakeExceptionWhenConnectionHeaderIsAbsent","file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13Test.java"},"deprecated":false,"digest":{"function_hash":"218822076986047941242336522899554650873","length":992},"id":"CVE-2026-44891-67616a87","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-44891-6892ad8a","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/multipart/DiskFileUploadTest.java"},"deprecated":false,"digest":{"line_hashes":["51207403480066258488784471954299753832","248804557870206198663856006235412345061","310607415136469651365453013807522505541","272064846190016890506852726246804200936","327607197461993826903526486009572004866","90329182912149836421770138118250859642","332498319026045051449722964560019689815","213060280920998629452608809741318363662","125495084294173188986382215589628417763","105523266265807790022255172145268130265","56616524641658297818229843311759366706","61902124454785772289718673070171652196"],"threshold":0.9}},{"deprecated":false,"digest":{"line_hashes":["327158723351793588753640188077467485341","146637049070509916435609360486853342571","35224337321040372889677481702655949088","335376998431465025074804024510544983191","251090133384968034835274170030296466869","103759568539672511053292433675239569467","39857019549897038040177004091972883629","89510112780916572415402718496857975786","317289685401950499366496800087066653959"],"threshold":0.9},"id":"CVE-2026-44891-6a792f6b","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-xml/src/test/java/io/netty/handler/codec/xml/XmlFrameDecoderTest.java"}},{"digest":{"line_hashes":["9660141043076714503167095626823739827","276333351894666188804085772883205086692","325023561945923213561644144929318617045","46788137048226862289831583886411286223","207504350281914285403612714033222753368","294961447519946136964619051743219236217"],"threshold":0.9},"id":"CVE-2026-44891-6bdc1a80","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java"},"deprecated":false},{"target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13Test.java"},"deprecated":false,"digest":{"line_hashes":["30095924792725353049592342827015250504","7537435876299410784959352768248653075","205058797462265081174598878308315539986","131243414189239640125946824926814850343","238297091305974838264967062180918450699","51574811832867142368735471093372743020","208803867246901256140489748198539816110","102151755742996960466184358990770221801","100690092525409667920595410575254627146","154247263480263394440631955024389082606","218037023052437383449004694272348824885","127309173328132178976389915096447141956","66236130474733987024127154504734947080","100991498246901488317508687094098641419","268917977241114822173172145507896224881","321158938244947531898791366266123496364","288194514225557220296969021800649835792","294222469956471090669937399174201636257","254535260616749409230515753624751058999","321211807033357791832080099138088887036","151430651347203995116212609348293870772","250526102206450122959264131889304814787","330924150844402191569345325851155074488","296654490499654448384919105821031541226","279418251082376816680865303888953711404","8734657677312631819125168446568749342","176218577768157812059610817561698078661","85683580641532692503248419137228580314","194663189022640858274526619658046430177","82447293130104294291818552739573025064","221591663300740565450382898700436686990","147120792792522804693003080376991656880","322392968081525380774338367341276081088","148619824319935871744761192984149633736","73722785790617638421295045709096391132","52422583122503304107029478960657754258","116526414688963444581733630071001937098","336599376638782785085009746772926760033","84928727959008278421820763542492324817","97271244734273626290487703052599020717","238533727860571715633044635460342108717","254535260616749409230515753624751058999","321211807033357791832080099138088887036","151430651347203995116212609348293870772","330549881938372840331511721015003813420","117448146373001890137826908059230794534","39905640067325643003323188753751880037","197121692985844362757601829448784376368","279418251082376816680865303888953711404","8734657677312631819125168446568749342","176218577768157812059610817561698078661","85683580641532692503248419137228580314","194663189022640858274526619658046430177","82447293130104294291818552739573025064","221591663300740565450382898700436686990","147120792792522804693003080376991656880","322392968081525380774338367341276081088","148619824319935871744761192984149633736","73722785790617638421295045709096391132","52422583122503304107029478960657754258","116526414688963444581733630071001937098","336469149237969719038814786206090200516","233118734412568765208665274304795360630","226509496498919570670286938397193751488","201278996994109393615418412676587563482","254535260616749409230515753624751058999","321211807033357791832080099138088887036","151430651347203995116212609348293870772","75345250702547955035624663202154990070","324478557979082351744506307960220674816","67088239501587617483397078768541772092","150982324211004900056813726503057736868","31742899616471827689767561086238104204","8734657677312631819125168446568749342","176218577768157812059610817561698078661","85683580641532692503248419137228580314","194663189022640858274526619658046430177","82447293130104294291818552739573025064","221591663300740565450382898700436686990","147120792792522804693003080376991656880","84909482808119743688787787522094403694","265986778908489104847221967863818801753","243877447548293352434580321870911676037","316845748707764124985432604911691041442","326667864961505955457685795890832439306","61140464027490366685033124603020853152","305474316019395334492831717287370906162"],"threshold":0.9},"id":"CVE-2026-44891-6c6a2153","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"deprecated":false,"digest":{"length":552,"function_hash":"310029567434725216849628932242206504287"},"id":"CVE-2026-44891-6d0e7838","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/test/java/io/netty/handler/ssl/ocsp/OcspClientTest.java","function":"simpleOcspQueryTest"}},{"deprecated":false,"digest":{"function_hash":"299521081110227015211366036970650967762","length":180},"id":"CVE-2026-44891-6ea2e72c","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-dns/src/main/java/io/netty/handler/codec/dns/DnsCodecUtil.java","function":"decompressDomainName"}},{"deprecated":false,"digest":{"length":829,"function_hash":"297425456249729526101048227087252242059"},"id":"CVE-2026-44891-710cd28e","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java","function":"checkAddress"}},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyFrameDecoder.java","function":"SpdyFrameDecoder"},"deprecated":false,"digest":{"function_hash":"76062077272985545312107626768023993004","length":301},"id":"CVE-2026-44891-72469332","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"227933398176940950470306249873990351439","length":217},"id":"CVE-2026-44891-750899c4","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3ClientConnectionHandler.java","function":"Http3ClientConnectionHandler"},"deprecated":false},{"id":"CVE-2026-44891-75584b6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java","function":"encodeFullFrame"},"deprecated":false,"digest":{"function_hash":"2876129745855369406358828415144086041","length":293}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec/src/main/java/io/netty/handler/codec/compression/Bzip2BlockDecompressor.java"},"deprecated":false,"digest":{"line_hashes":["120636894138568611417665334976744298814","231663183013581773918805076445939278113","65728032641867946651785835381755137609","221632879600518765062448949766145744292"],"threshold":0.9},"id":"CVE-2026-44891-75806b8b","signature_type":"Line"},{"digest":{"line_hashes":["215182408093000288455729677959792714705","166666170635990664460918214156295336043","245995820009975659899714545244822257100","50348118516633030433397738805442135183","173388259662917107739710383479963073606","29365316359408955423358960315334961898","300003777198588260233210529085963133774","324367323631872560452111097121663548296"],"threshold":0.9},"id":"CVE-2026-44891-78bb4916","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["76571461240793360179205533572957495184","206549433264693793952383182774883287621","9277775843935789717681416229613738029","116569623219545460757986823176325587694","214725248238271337439214902643205893250","202151072332979127151069186870263248578","122830590978394286278958476120199748604","166216103042126935894542172361473411239","164887466157254707659749936994592364302","186286122822615930617750917609741151673","255910682108530122062248791117173424894","132243448003633904246988388032365456954","99703832553208892947538345481457095547","74156037535529150278937098724520829103","9122070189882667463723817142243913286","137513402200814903173278044344917223225","262562265445008308360810622046059475292","54153242003189841689371467061264699232","147747752957845114212948130887746554926","296191385078721478413495185029760423988","305955598974551891614102962918751139365","303270526125740117634924459613995877937","123888134281299589336915735212491244882","74860724549959812767240220204864741969","275546611663785903062620823749280840619","103327163777706950948153343432076819589","24587051598198561183598655255149457979","144899020884403256567433442388164619491","177622185640700830046169864136503807167","270684297830509492670852714419968414525","31857438397549818699678360847703889661","29192672363464035985199021265459595478","42147788718765497062737246685253610314","334864814421610487917660877617496244489","143420780790010587505977872420871537468"],"threshold":0.9},"id":"CVE-2026-44891-798f5284","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/test/java/io/netty/handler/codec/stomp/StompSubframeEncoderTest.java"}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"function":"exceptionCaught","file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspServerCertificateValidator.java"},"deprecated":false,"digest":{"function_hash":"318029928101993199939194693949693196607","length":86},"id":"CVE-2026-44891-7b6d9a2c","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-redis/src/main/java/io/netty/handler/codec/redis/RedisArrayAggregator.java"},"deprecated":false,"digest":{"line_hashes":["233546309237886414295345360674402568960","171048139463872279378169252331233610706","149156141487420180961330513075367916941","304506414543801421346313800571328420568","20494441483757075073987675444581146955","286509145826521364911866453390303402097","116026940602797325682588178723926501117","219593989683839262659567759506453760061","52886726899292340609675509739810954146","255593300683083263249028612033622205528","322547090658323602134070240751962696175","282539225339452086708875888010389487354","57917196876322009600265307306434346113","270911487146534097738850758326462207027","165861613173804328690858713425063512487","14953908664060733649241468777070547943"],"threshold":0.9},"id":"CVE-2026-44891-7c9cf1de","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["203023643611192846430305066986548558971","104141026654384323289184202380571951030","322322889616215231971149706108536675401","110539386962464534387681177276384392607","226077568624785731671834860116979843789","79820806853625262592155161557648232567","83488455987490226221162160981323776117","35904041857316705446824990961750701405","128171568974453271688483294666099712152","299904024793260668101653504161920894067","246336118141007803560437170447330819815","39139531527211842251976579921834937632","99002612440620031811318211524427847478","1141245584306703130851203477621268123","193651821184646489676172857385889791106","42653679871454329828022489289854058739","153779634721489566290282731385927434594","236192416272058911052761018972721008619","46750689428136074667440932888318214029","86503318864730121318443223162577695370","291364361668651074846059517037058783050","206173745597733207711610983878846315457","96751692899979726801384650974249167458","169283331282831196763079301763445622785","213036933737457864683903623481860179145","247128216996397597206729835562642811014","179432644792515932186753805258319342885","218537193404562804798231985233243818477","337673536220533543469437103852032198178","303369677952391419999446328295135858877","85469357812541642905864782084040935088","78506990689394780000349151338330809474","226804655603336015550639361516015067187","23622590227774246513376567421382361232","234954545787370343599282583483751125139","45064314396996109242528830508518168980","99386248427370428597002960420704741464","122835034067845601164123553425888462298","152088170878512830845983552032139659868","286753947845110252195412680016485291013","305710963059892459414117551031488039929","114089034188960735913531723827661321956","81553664049783232705401130665475022751","313039934924815295920185908225644271322","18742756184025593207548765072266829235","63037824178495996395412101043158705021","293152264584901290526861662267158876200","264276006932366799529557308286294320014","177073009982618877340430394747588123427","327021589242068677282511013975913880357","178177520930710649663050903022312750676","307461930799843894124888836649912805620","57345108845033374035616061590435432672","94798546975183284613109876850404941224","1607960469470282495260451809258625817","189071836669197417870111566421272711121","202050096475550560283944274875755648229","245745429194983087146346868256557323790"],"threshold":0.9},"id":"CVE-2026-44891-7f1890f1","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspServerCertificateValidator.java"}},{"digest":{"line_hashes":["71182898787560325904575462663348732975","31725542544301116871194913910836769902","119969337150663626253074767251113238685","953319363372630143895565562247547209","100576412687396084306690656408523478136","193413575491687030131197505763803258832","156583693553782734281191274112705186363","101619042600244975609347946208590640916","225185337519122960635489602770317770849","94986780315441369562137866404302887441","207962998271968566628011142009966132560","142523494755535006413896002794455595958","205265774584368246470108541273528435050","263817841364458406554844531418960615303","11970821231753901346001074558237101505","113095154244126861855663218711155537274","29869145088257743476336475470707580101","143964644511201814324611895192940982139","232376447983589061266806449656092459882","8114045057466992560835084040971164819","186019688949669095584151745537165851495","210700478774727959757071611761226998793","68788917639673452241377764889323801834","327654661588036074332179899751482878380","269984888347107879737130311445979277535","38917974413484486844128179678320748555","227144035922674556853547949353064767454","156879725620184039404540577768253973450","265130908897882201057129382357087925792","284709602627839908241903828117596341722","79820139413864550538946595714246355589","276640312050226293319117183416018997394","251116248154932917237410044531560191814","311143060457452431203991288150517883819","206117034240465364826256146151310545406","194707926360422607689528801370317046189","8162293371831705572939428653349368927","183357260775761942099293984048188123947","327278591048541102019645329859074323709","6898800398549896855269341333883757525","158674141349300890461151838700384750616","87235086650453125113395188138884819333","84974665120075111219826841759507257869","117745924506407933815319055387729297387","88513833443385516992360233120149233260","56633494108299943341771862131462833473","32844143060089022942922956695233771342","149538612318698413681345854363740716337","11855280900747258312590874216415383456","28468600491638739423634366526405451598","250888431761727825256773376285144795568","63685134680601053787986471866874062147","126790359920638380463435247528558048040","183166210601465775602117004606532348914","74006510139886820265090714436237173632","64952767840870759058168228249357253779","4149865153886428280753690619954987824","264664389131361404755327142345473798887","114247364668277063969160024795088680412","198946831123579435195332292348895700387","238531245921237845612995248667329427526","122067452584392437142744981873262641588","168282457349028579317539822704603859339","197616840944409057890547713444451384480","27537125801120894839956508210994654325"],"threshold":0.9},"id":"CVE-2026-44891-8038630e","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"10795440751191988041233867027603607931","length":673},"id":"CVE-2026-44891-814f580a","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java","function":"HAProxyMessage"}},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/multipart/MemoryFileUploadTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["225175903188277750106034678214274430805","329386511271750546924864530957973029068","137750074093720672737159179826424119782","36536058132949522733991968341172205711"]},"id":"CVE-2026-44891-81800e4c","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"110299258662903059983082317052609318701","length":242},"id":"CVE-2026-44891-829a84b6","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"initChannel"}},{"digest":{"line_hashes":["74266644962816536446962297321223189604","301930874733366798286746926672462980331","39539511746329286156935312545147176033","220476366281893180134898027728468482540","2990444965863727127400438988476281308","307659593766027796344894026647493516039","15928223785990460031080493006365712181"],"threshold":0.9},"id":"CVE-2026-44891-829d9b8f","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/spdy/SpdyFrameDecoderTest.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/test/java/io/netty/handler/codec/stomp/StompSubframeEncoderTest.java","function":"testNotEscapeStompHeadersForConnectCommand"},"deprecated":false,"digest":{"function_hash":"249912671355718854669734932938515923365","length":473},"id":"CVE-2026-44891-82d96020"},{"deprecated":false,"digest":{"line_hashes":["291054961061731036889788492354043528097","307835953759758337182921654025042319289","255097378483430222270242582334463576846","77682605070388622563158559819132198716","3532544664832851183907498827491415800","178723791085334524418221686428836776226","49121689331881652683783074781490354455","74930173220282156607096321412712551791","197979736876585198678443100927057288895","315267193549414034542744255788168588657","168620905001372379756103157156797359137","60607511887430988895049349275251612070","122954445369940013049476415410349051639","35368941597152954393192191521581666639","218040308962606622250896002637845722989","232834135447692909290328051188562063092","257791368900577226295827498665154571011","32410494252454085594245727606286737361","287998128639060313010299792795329666730","186874578982781780815622855902837451877","253044694637245796760386698571089939172","289006723964214089239340788429054368860","206933853523366594484274598121286781139","165893840880885469363862059137052988184","313062874559803305729767213021473414658","118003671665161165572267150211526521268","39164213128054881587633417764506861747","159730568002000646301875170804744602818","226020919421608365483751952974434808515","68395135449656833044632824699231522801","259628092768672802434140960799448195340","324329350100542810474613550148246887728","268285377387170007356528687841372111749","45401112947766270859545563607890291182","28437189102955900890879066876941589135","238393033461339229947550405699498249336","234979728885706510185730320049239067581","113293081678574841292744495769889505379","179315467108985371738145155779119622638"],"threshold":0.9},"id":"CVE-2026-44891-85cbb43e","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec/src/main/java/io/netty/handler/codec/xml/XmlFrameDecoder.java"}},{"id":"CVE-2026-44891-86906c76","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/multipart/MemoryFileUploadTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["225175903188277750106034678214274430805","329386511271750546924864530957973029068","137750074093720672737159179826424119782","36536058132949522733991968341172205711"]}},{"digest":{"line_hashes":["246784991484037751767225717438938276066","301899497419458330050361101571198454890","332772833684705405124605840767821791954"],"threshold":0.9},"id":"CVE-2026-44891-88ca3da9","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3CodecUtils.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspServerCertificateValidator.java"},"deprecated":false,"digest":{"line_hashes":["203023643611192846430305066986548558971","104141026654384323289184202380571951030","322322889616215231971149706108536675401","110539386962464534387681177276384392607","226077568624785731671834860116979843789","79820806853625262592155161557648232567","83488455987490226221162160981323776117","35904041857316705446824990961750701405","128171568974453271688483294666099712152","299904024793260668101653504161920894067","246336118141007803560437170447330819815","39139531527211842251976579921834937632","99002612440620031811318211524427847478","1141245584306703130851203477621268123","193651821184646489676172857385889791106","42653679871454329828022489289854058739","153779634721489566290282731385927434594","236192416272058911052761018972721008619","46750689428136074667440932888318214029","86503318864730121318443223162577695370","291364361668651074846059517037058783050","206173745597733207711610983878846315457","166158969985890410664174581230674625330","78300940704661165447950089736132581187","211985626966845064755635379377847311294","66603544088488388913646248143647532373","269467612529417973562811406565729596408","298463516226871179160271363843394905595","231050815205282307276536825162787253689","282012606212799856358696409477756887555","337673536220533543469437103852032198178","303369677952391419999446328295135858877","85469357812541642905864782084040935088","78506990689394780000349151338330809474","226804655603336015550639361516015067187","23622590227774246513376567421382361232","234954545787370343599282583483751125139","45064314396996109242528830508518168980","99386248427370428597002960420704741464","122835034067845601164123553425888462298","152088170878512830845983552032139659868","286753947845110252195412680016485291013","305710963059892459414117551031488039929","114089034188960735913531723827661321956","81553664049783232705401130665475022751","313039934924815295920185908225644271322","18742756184025593207548765072266829235","63037824178495996395412101043158705021","293152264584901290526861662267158876200","264276006932366799529557308286294320014","147858324038593158500684694027223964839","225344280033647981012291380777809552020","79857656579781679713873665099933085318","178177520930710649663050903022312750676","307461930799843894124888836649912805620","57345108845033374035616061590435432672","94798546975183284613109876850404941224","1607960469470282495260451809258625817","189071836669197417870111566421272711121","202050096475550560283944274875755648229","245745429194983087146346868256557323790"],"threshold":0.9},"id":"CVE-2026-44891-88cc7ae4","signature_type":"Line"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["116821410237117041108277767088694593381","274457559659800330936849547928038705918","234639610510487449617634523480690234962","220831888384828359373456745614693019338"]},"id":"CVE-2026-44891-8dd67c41","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker08.java"}},{"deprecated":false,"digest":{"function_hash":"175735896065295538372251057322078967917","length":1532},"id":"CVE-2026-44891-8e177805","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker08.java","function":"newHandshakeResponse"}},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspHttpHandler.java"},"deprecated":false,"digest":{"line_hashes":["33419047885776515783743983592435706151","120352067145491294345958942702663811767","195818797374754609844615086972514488677","247323321822647248618564668415187530006","21691826279848268048300849622793650813","101984695432210075257641518475480681424","317781255596167820325798775006278530204","127082689337489543642677274013055816313","292583044569800847619459337837869792031","183589364534110556272182657624765380982","255086003830844110449252355105610040335","91928940405509196731075063814043644405","192181032577053251190207797028036804961","48164079053714244211083745838949487620","104974042836130463410037188845774637522","194688980860364871878859594915459210933","316887010127580466247889216706034178680","27787693360671753964846451265534263407","150843397187196636133182722079651841437","55006319333103950736450852321132686135","237765601347400524689911827606037631193","8468731914484715452809477093773189864","96342194362684967664383738751692710315","239076586194324360028936641072148277210","87838872839648455503607887512592903751","111577162655881404267918058199469813516","288952071575803718391675807969541225689","38679765214304975122307842729536669509","1607960469470282495260451809258625817","206675032356986279961516893343201605118","119029320071812693647455558113805398746","213412509357151740027271321817987126429"],"threshold":0.9},"id":"CVE-2026-44891-8fe1875a","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java","function":"cleanString"},"deprecated":false,"digest":{"function_hash":"10136683705229378616467463044735851786","length":536},"id":"CVE-2026-44891-9162c815","signature_type":"Function"},{"digest":{"line_hashes":["289589371407724941027865520138414194198","44180767926753992353896882624097923544","228324260497123778114866393953590614847","323344959370884306360969541162389141773","228827500599399636207857239704800201443","204242865643896690865120250583974877134","174653218091944314744909480991884923348","100911385523467371306475337172156079988","125972357147270616959444863392036292180","185576918399064693769245320862080253814","73279680051815879668628323951740046864","281269823248768859485245749207012322299","259358861207724151538138303042909838802","80011698943881026307423884911622147496","80746681379275779146593596149555586330"],"threshold":0.9},"id":"CVE-2026-44891-9337faac","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHeaderBlockZlibDecoder.java"},"deprecated":false},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/HttpContentEncoder.java","function":"decode"},"deprecated":false,"digest":{"function_hash":"159847160250759320602810083525322292892","length":655},"id":"CVE-2026-44891-96699f05","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-44891-998f7318","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java","function":"StompSubframeDecoder"},"deprecated":false,"digest":{"function_hash":"155246494514114739496685541720103862788","length":92}},{"deprecated":false,"digest":{"line_hashes":["116821410237117041108277767088694593381","274457559659800330936849547928038705918","234639610510487449617634523480690234962","220831888384828359373456745614693019338"],"threshold":0.9},"id":"CVE-2026-44891-9a550142","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker08.java"}},{"deprecated":false,"digest":{"function_hash":"278949051441729616347092541160385134778","length":403},"id":"CVE-2026-44891-9ada11e3","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"validateResponse"}},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker00Test.java"},"deprecated":false,"digest":{"line_hashes":["132857200373237802621386637946607647113","61127478361417608997233252217306581854"],"threshold":0.9},"id":"CVE-2026-44891-9d0059ef","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["84808049616415674528682188482520180891","80160179035593330160466054200675336356","314797420850615837403584325870997460442","265944277859398738040726804244372343030","10725644326362388873554828450541356580","319173447024993203312423096356108327109","89260164218482525505812787338330414479","220357460906614020545498837850476499645","52752902412960174864648471680555918358","131740286517794619545449398580906563831","214481227624474552358278297808286486427","4893776025497836391456286944474353130","36368193411033736286162496069377272617"],"threshold":0.9},"id":"CVE-2026-44891-9d9b3431","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http2/src/main/java/io/netty/handler/codec/http2/HttpConversionUtil.java"}},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"function":"decode","file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHeaderBlockZlibDecoder.java"},"deprecated":false,"digest":{"function_hash":"11783242442417011635617480254339845601","length":286},"id":"CVE-2026-44891-9eaeaee1","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-44891-9efa5653","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/test/java/io/netty/handler/ssl/ocsp/OcspClientTest.java"},"deprecated":false,"digest":{"line_hashes":["308906240941240756416131894849203284397","273620425434884604809333991084395290674","336877504368542181907594337275654713055","76311601367999310450994386788864776195","226660731004634968521404569724416693365","275386147433241590504122329786432864565","67073495204390542176769243451791812929","337061134077865752787200194295660467143","326470193639285646375474064802517477505","237670917270727398445932634530053375516","278905885629726550705144842458601448863","301940537136780811123222152074876386280","127268652017784119211113153248983534907","258178815953404949065807544621061650392","296223852556315562542296200115190601308","107388138724798420335748978771343201559","281487314526881440024969972129090559569","22198775756416102221506719712828777076","5408168028977028901784697058369594995","143748534152733903502826656600301193730","234441555722625367679021786602257367340","234695952860573060823215251167211994435","94233564632207201573054062898792027670","194473644569612049891295764087672170057"],"threshold":0.9}},{"target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/HttpContentEncoderTest.java"},"deprecated":false,"digest":{"line_hashes":["172013050884991683488590728540336593142","335657993299234137396508154959648311623","142718830088658019156516157260030237716","206535563861374960247829131538297890013","158369500946582605747179361914195286690","241472630589226420242837396792321853404","240563036243152161285851997338211957996","124021888710218370532958828180321821647","271136652821827806183711847625915871303","260390810753422853267386379277568938405","300251567441907825130842825027073774440"],"threshold":0.9},"id":"CVE-2026-44891-a13cbd5c","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyFrameDecoder.java"},"deprecated":false,"digest":{"line_hashes":["317604031820060118453154956993093684717","24873742710002895818134491604392062031","114076331002914605831157811091363512751","129155374381983620206647657666718803900","273934057914773020445401690645104830644","271096040010193221535560976200559268748","290639620904545869211648454889152674971","334256796902082616817282979901037794356","113722296319761634041515489835492615054","202905611593170866299233151191528269316","137368756049624756721723231633953444526","287141344036298448640388506882806594002","97538379800756998626675400391820040951","318814246010180669436408818179429798289","209841647201342990906907102603208796005","308887872369250698363447449227166337682"],"threshold":0.9},"id":"CVE-2026-44891-a2761f39","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["116821410237117041108277767088694593381","274457559659800330936849547928038705918","234639610510487449617634523480690234962","220831888384828359373456745614693019338"],"threshold":0.9},"id":"CVE-2026-44891-a3f0942c","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker07.java"}},{"id":"CVE-2026-44891-a563fe2e","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java"},"deprecated":false,"digest":{"line_hashes":["160856727183441628202072251565823803095","105749132124367098035389648295487021464","118185513643260554908741716036402767856","83708985391929940133118263479536866566","311492259179391967641018178727592688967","89368361429369981390973534115563368581","77193987120142002508296462090157492410","139851497706414496087195643402254450167","39662224170809360398344969026899457523","178816243284968540841210495673910482227","176287640514349733141158040386906513598","303665514185620789986397669285487412138","297739096657727811260082502255166650770","136572713293192237495034777693097852011","158745396765987017925033669780165034429","240980895617077683768741812290916815183","30015959068743022629301560091843739396","239637474864958538866950879400282099672","55627591212767070003742815130074663843","33545055825566805281471658140956238643","1599870427874156370699958205848303850","241199099516041511318134287525761930307","246871629290293414168368597517471460303","260607150530821294586258494351141961373","74360914599811584596350433122742324491","328723346762203766422198579327933561424","268658860689973553848984173042110766991","222513809318578456911917473746657710374","126955523728942222450288430081022540808","98673459035885338343719438331613830778","336958556695484310824152553137121440588","329954361153472128459209824337947753109","238002347403422063848421268354161563879","205601945213753446539650461657182213303","2450118565105161870620091343280108277","224884316399012034779596116030132226295","56237681584886468665470618506553056075"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"function":"Initializer","file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java"},"deprecated":false,"digest":{"function_hash":"54946750876090677008110994659516782338","length":84},"id":"CVE-2026-44891-a6048eb3"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/HttpContentEncoder.java"},"deprecated":false,"digest":{"line_hashes":["283179859870524845797877371650239077067","293143580281501283944030300363274085592","178839704332000151183983533540151740283","230160714309809686873582923953038940141","264206261618560540615643200663267403542","302459704075356583972235224038759838139","37107057865595085469849483021709543208","182606988728277637093169144598888544372","92460093428818057124091083193825366805","270282705847449359243973034369359703311"],"threshold":0.9},"id":"CVE-2026-44891-a6df3a50","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["156752510038407923441450894742669625510","55915757974275319165450151800440635830","166836323056633657946759736202737049630","307799663942416250575839223636423233484","163575489982936682653802420913792867427","41003518262735134244896737105600871815","12887326223628438565177135006897777278"],"threshold":0.9},"id":"CVE-2026-44891-a7b32aba","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-xml/src/main/java/io/netty/handler/codec/xml/XmlDecoder.java"}},{"id":"CVE-2026-44891-a899ef11","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/MemoryFileUpload.java","function":"setFilename"},"deprecated":false,"digest":{"length":96,"function_hash":"109888083554817988562479215027287151321"}},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java"},"deprecated":false,"digest":{"line_hashes":["235036769015100095960476662614851768947","106432843125135978645536772495575421270","185181125721932247846926860451759832986","66555547424044998101488061467293134363","237931008944134959779715416113481894720","198286761853788273330334869439987826647"],"threshold":0.9},"id":"CVE-2026-44891-ac925a27","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"27406508228629608708750647100114768450","length":267},"id":"CVE-2026-44891-ad4e37dc","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3ClientConnectionHandler.java","function":"Http3ClientConnectionHandler"}},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/multipart/DiskFileUploadTest.java"},"deprecated":false,"digest":{"line_hashes":["51207403480066258488784471954299753832","248804557870206198663856006235412345061","310607415136469651365453013807522505541","272064846190016890506852726246804200936","327607197461993826903526486009572004866","90329182912149836421770138118250859642","332498319026045051449722964560019689815","203793385041720505514574813504419870051","314729626411044164552252217325252276133","117952108350639311910309327542797792648","56616524641658297818229843311759366706","61902124454785772289718673070171652196"],"threshold":0.9},"id":"CVE-2026-44891-ad598122","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"function":"encodeHeaders","file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java"},"deprecated":false,"digest":{"function_hash":"123816676250845503850654196242282238637","length":812},"id":"CVE-2026-44891-adba0e49","signature_type":"Function"},{"id":"CVE-2026-44891-b0689dc4","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http2/src/main/java/io/netty/handler/codec/http2/HttpConversionUtil.java"},"deprecated":false,"digest":{"line_hashes":["84808049616415674528682188482520180891","80160179035593330160466054200675336356","314797420850615837403584325870997460442","265944277859398738040726804244372343030","10725644326362388873554828450541356580","319173447024993203312423096356108327109","89260164218482525505812787338330414479","220357460906614020545498837850476499645","52752902412960174864648471680555918358","131740286517794619545449398580906563831","214481227624474552358278297808286486427","4893776025497836391456286944474353130","36368193411033736286162496069377272617"],"threshold":0.9}},{"digest":{"function_hash":"109888083554817988562479215027287151321","length":96},"id":"CVE-2026-44891-b29270a4","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/DiskFileUpload.java","function":"setFilename"},"deprecated":false},{"digest":{"function_hash":"37240048901434324545494198502901448906","length":475},"id":"CVE-2026-44891-b41ad748","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"function":"read","file":"codec-compression/src/main/java/io/netty/handler/codec/compression/Bzip2BlockDecompressor.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"336662453225324985127911165861354363222","length":1785},"id":"CVE-2026-44891-b4f2bdc2","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"query"}},{"source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"initChannel"},"deprecated":false,"digest":{"function_hash":"110299258662903059983082317052609318701","length":242},"id":"CVE-2026-44891-b715ce72","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"297425456249729526101048227087252242059","length":829},"id":"CVE-2026-44891-b721b84b","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-haproxy/src/main/java/io/netty/handler/codec/haproxy/HAProxyMessage.java","function":"checkAddress"}},{"deprecated":false,"digest":{"line_hashes":["210487469709993018946593903423719582547","130724509949588184105507332306894095139","22474414532091580761078880212747849047","225630877187236799390552268909047827302","197027764089074631067444755455408745962","226788896474870726819247150991299898032","292060969778153768668622738560881961512","232174298968862908060688149883484266801","285823354400975707127423997699222540997","94187106096585950946608561942613816257","165011897109126306683185927304303904917","13677811257393940852768844033360224142","155780830974220869428313754896524684323","90095877476699994743093514730401546129","126546816661870215625912107743872363733","260440758164739794050026786210902848338","246516369531451335066322616145245346991","306231757832113801325551108904910699798","310681505361450751512454540219093283915","172524719171014108614907351721157163383","337613516404125649607083152749453768997","86704014280383412150779084046034542555","338068876074801839014042260969143318893","83494757878111606097838750835564068593","328420035650261915461173907211142302227","152173737140766228125828211238854142263","286949852357004928261828725057000069265","318512679575830029399952710282053784575"],"threshold":0.9},"id":"CVE-2026-44891-b824dc46","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3FrameCodec.java"}},{"digest":{"function_hash":"335346898954355686823313366025215295813","length":1359},"id":"CVE-2026-44891-b839f1e8","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"run"},"deprecated":false},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13.java","function":"newHandshakeResponse"},"deprecated":false,"digest":{"function_hash":"56195306883292554399771619923366752881","length":1975},"id":"CVE-2026-44891-bb285655","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["30095924792725353049592342827015250504","7537435876299410784959352768248653075","205058797462265081174598878308315539986","131243414189239640125946824926814850343","238297091305974838264967062180918450699","51574811832867142368735471093372743020","208803867246901256140489748198539816110","102151755742996960466184358990770221801","100690092525409667920595410575254627146","154247263480263394440631955024389082606","218037023052437383449004694272348824885","127309173328132178976389915096447141956","66236130474733987024127154504734947080","100991498246901488317508687094098641419","268917977241114822173172145507896224881","321158938244947531898791366266123496364","288194514225557220296969021800649835792","294222469956471090669937399174201636257","254535260616749409230515753624751058999","321211807033357791832080099138088887036","151430651347203995116212609348293870772","250526102206450122959264131889304814787","330924150844402191569345325851155074488","296654490499654448384919105821031541226","279418251082376816680865303888953711404","8734657677312631819125168446568749342","176218577768157812059610817561698078661","85683580641532692503248419137228580314","194663189022640858274526619658046430177","82447293130104294291818552739573025064","221591663300740565450382898700436686990","147120792792522804693003080376991656880","322392968081525380774338367341276081088","148619824319935871744761192984149633736","73722785790617638421295045709096391132","52422583122503304107029478960657754258","116526414688963444581733630071001937098","336599376638782785085009746772926760033","84928727959008278421820763542492324817","97271244734273626290487703052599020717","238533727860571715633044635460342108717","254535260616749409230515753624751058999","321211807033357791832080099138088887036","151430651347203995116212609348293870772","330549881938372840331511721015003813420","117448146373001890137826908059230794534","39905640067325643003323188753751880037","197121692985844362757601829448784376368","279418251082376816680865303888953711404","8734657677312631819125168446568749342","176218577768157812059610817561698078661","85683580641532692503248419137228580314","194663189022640858274526619658046430177","82447293130104294291818552739573025064","221591663300740565450382898700436686990","147120792792522804693003080376991656880","322392968081525380774338367341276081088","148619824319935871744761192984149633736","73722785790617638421295045709096391132","52422583122503304107029478960657754258","116526414688963444581733630071001937098","336469149237969719038814786206090200516","233118734412568765208665274304795360630","226509496498919570670286938397193751488","201278996994109393615418412676587563482","254535260616749409230515753624751058999","321211807033357791832080099138088887036","151430651347203995116212609348293870772","75345250702547955035624663202154990070","324478557979082351744506307960220674816","67088239501587617483397078768541772092","150982324211004900056813726503057736868","31742899616471827689767561086238104204","8734657677312631819125168446568749342","176218577768157812059610817561698078661","85683580641532692503248419137228580314","194663189022640858274526619658046430177","82447293130104294291818552739573025064","221591663300740565450382898700436686990","147120792792522804693003080376991656880","84909482808119743688787787522094403694","265986778908489104847221967863818801753","243877447548293352434580321870911676037","316845748707764124985432604911691041442","326667864961505955457685795890832439306","61140464027490366685033124603020853152","305474316019395334492831717287370906162"],"threshold":0.9},"id":"CVE-2026-44891-bb51bd54","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13Test.java"}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-dns/src/main/java/io/netty/handler/codec/dns/DnsCodecUtil.java"},"deprecated":false,"digest":{"line_hashes":["144335126249663443825326065022284199901","284836128191799717218408827652601465004","201224408327860405375979092836270875777","146644009297364346493115010485249368242","27959559760793966902178019669445130160","292658081675404076645772265698203539455","64600387313959240170931702109936638782","39420768727777720589375927192115550958"],"threshold":0.9},"id":"CVE-2026-44891-bc5d0ac9","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["76571461240793360179205533572957495184","284526074985489190220706315212850108148","32679306466974974772639307458847741494","46432974478981562266833662746703085437","322761577482041636903947734541456912539","5261341792796232694396663218625177188","191301281738289231831709372761189177786","177771857949931981918452586780526911192","87753945271299953963873994276907119237","87942357236485403927753532389381431273"],"threshold":0.9},"id":"CVE-2026-44891-bd7e2057","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/test/java/io/netty/handler/codec/stomp/StompSubframeDecoderTest.java"}},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"function":"testNotEscapeStompHeadersForConnectedCommand","file":"codec-stomp/src/test/java/io/netty/handler/codec/stomp/StompSubframeEncoderTest.java"},"deprecated":false,"digest":{"function_hash":"327225770290667286573364391638073645393","length":477},"id":"CVE-2026-44891-bda544c9","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-44891-bedc7fcd","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"function":"operationComplete","file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspServerCertificateValidator.java"},"deprecated":false,"digest":{"length":838,"function_hash":"5390706222979191929102692898271694111"}},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"operationComplete"},"deprecated":false,"digest":{"function_hash":"208778930891294855441589512737431679842","length":287},"id":"CVE-2026-44891-bf299c6c","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["9660141043076714503167095626823739827","276333351894666188804085772883205086692","325023561945923213561644144929318617045","46788137048226862289831583886411286223","207504350281914285403612714033222753368","294961447519946136964619051743219236217"],"threshold":0.9},"id":"CVE-2026-44891-bfde8233","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java"}},{"digest":{"line_hashes":["300577177173333653220623478705162610804","334115406407850863177922300462689801030","219265018885931866228175740784706168804","102388623909325049630131000664888705330","179161482716674097018460997460540139581","296919889291562822503487588561948795398","274628771904830941483873610595637613241","216302050802671294652420443724034175946"],"threshold":0.9},"id":"CVE-2026-44891-c1132422","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/spdy/SpdyHeaderBlockZlibDecoderTest.java"},"deprecated":false},{"target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/cors/CorsHandler.java"},"deprecated":false,"digest":{"line_hashes":["270762246741101941642542572106199202165","44240978820938050603617821743305127713","180327344206548645876772916274966899843","211735656644421554895276610523137416957"],"threshold":0.9},"id":"CVE-2026-44891-c6d25c13","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"id":"CVE-2026-44891-c804b844","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-xml/src/main/java/io/netty/handler/codec/xml/XmlFrameDecoder.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["291054961061731036889788492354043528097","307835953759758337182921654025042319289","255097378483430222270242582334463576846","77682605070388622563158559819132198716","3532544664832851183907498827491415800","178723791085334524418221686428836776226","49121689331881652683783074781490354455","74930173220282156607096321412712551791","197979736876585198678443100927057288895","315267193549414034542744255788168588657","168620905001372379756103157156797359137","60607511887430988895049349275251612070","122954445369940013049476415410349051639","35368941597152954393192191521581666639","218040308962606622250896002637845722989","232834135447692909290328051188562063092","257791368900577226295827498665154571011","32410494252454085594245727606286737361","287998128639060313010299792795329666730","186874578982781780815622855902837451877","253044694637245796760386698571089939172","289006723964214089239340788429054368860","206933853523366594484274598121286781139","165893840880885469363862059137052988184","313062874559803305729767213021473414658","118003671665161165572267150211526521268","39164213128054881587633417764506861747","159730568002000646301875170804744602818","226020919421608365483751952974434808515","68395135449656833044632824699231522801","259628092768672802434140960799448195340","324329350100542810474613550148246887728","268285377387170007356528687841372111749","45401112947766270859545563607890291182","28437189102955900890879066876941589135","238393033461339229947550405699498249336","234979728885706510185730320049239067581","113293081678574841292744495769889505379","179315467108985371738145155779119622638"]}},{"target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspHttpHandler.java","function":"channelRead0"},"deprecated":false,"digest":{"function_hash":"148769302880170977174187723693543641064","length":801},"id":"CVE-2026-44891-ca206900","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"target":{"file":"codec-dns/src/main/java/io/netty/handler/codec/dns/DefaultDnsRecordDecoder.java"},"deprecated":false,"digest":{"line_hashes":["6824265245759376681920259781050386316","242498962665045566338481960659072215785","23162040932569393978586535154164415827","315744331822506146101998695239907614057","217912431069155449070796477345199034493","79336991594580389109891421564756054","296028145518921231660070789079175450226","302060337389211543317724635036410782228","308051361637886027886725330763733017724","246794346306455821634547109978533689082","312987364280858726404236213455474488208","235440393173817311278493945903941487556","289200999983206267863812043006504833111","264072080363553910515491799896025737978","147343901762383993578740675379460094672","19240966935348767001171731323886840368","124006299502011933802849989607028983058","281414852450730059361378931245325210899","20310700185611001647801606001754101580","66905211013575359036015406514975423914","269842649486392816948385443837445988299","44262056761219845075531251679578306509","48687507940012810143328438394770483671","51162542862627663918192777359230324524","215130032490703768744689897355611136303","3850095144291681241727786468222353354","108139682920200659433219967486450171661","256649143699176351579433102523926682174"],"threshold":0.9},"id":"CVE-2026-44891-cd8685cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"function":"decode","file":"codec/src/main/java/io/netty/handler/codec/xml/XmlFrameDecoder.java"},"deprecated":false,"digest":{"length":1899,"function_hash":"70647407349868769204503066540447859707"},"id":"CVE-2026-44891-cf47c64e","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"154334759911960807374640596735255054145","length":615},"id":"CVE-2026-44891-d0f5b5bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java","function":"escape"}},{"digest":{"function_hash":"149825911895313533733982773141223336857","length":6474},"id":"CVE-2026-44891-d1624a38","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyFrameDecoder.java","function":"decode"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"query"},"deprecated":false,"digest":{"function_hash":"222770168165450922917121183208364978018","length":1799},"id":"CVE-2026-44891-d275541f","signature_type":"Function"},{"target":{"file":"codec-stomp/src/test/java/io/netty/handler/codec/stomp/StompSubframeEncoderTest.java"},"deprecated":false,"digest":{"line_hashes":["76571461240793360179205533572957495184","206549433264693793952383182774883287621","9277775843935789717681416229613738029","116569623219545460757986823176325587694","214725248238271337439214902643205893250","202151072332979127151069186870263248578","122830590978394286278958476120199748604","166216103042126935894542172361473411239","164887466157254707659749936994592364302","186286122822615930617750917609741151673","255910682108530122062248791117173424894","132243448003633904246988388032365456954","99703832553208892947538345481457095547","74156037535529150278937098724520829103","9122070189882667463723817142243913286","137513402200814903173278044344917223225","262562265445008308360810622046059475292","54153242003189841689371467061264699232","147747752957845114212948130887746554926","296191385078721478413495185029760423988","305955598974551891614102962918751139365","303270526125740117634924459613995877937","123888134281299589336915735212491244882","74860724549959812767240220204864741969","275546611663785903062620823749280840619","103327163777706950948153343432076819589","24587051598198561183598655255149457979","144899020884403256567433442388164619491","177622185640700830046169864136503807167","270684297830509492670852714419968414525","31857438397549818699678360847703889661","29192672363464035985199021265459595478","42147788718765497062737246685253610314","334864814421610487917660877617496244489","143420780790010587505977872420871537468"],"threshold":0.9},"id":"CVE-2026-44891-d30eab07","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"id":"CVE-2026-44891-d3f14394","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshakerTest.java"},"deprecated":false,"digest":{"line_hashes":["276113160309829117974824003364488810184","135980683857183404361006806776767282637","507981228172429656527024184285440560","270806507045708637137967600940037731815","17295407340861614269193684007444842369","152315126817788600715035560776443638804"],"threshold":0.9}},{"digest":{"function_hash":"19711077448101257361666803412315960086","length":589},"id":"CVE-2026-44891-d564683e","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java","function":"encode"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-redis/src/main/java/io/netty/handler/codec/redis/RedisArrayAggregator.java","function":"decodeRedisArrayHeader"},"deprecated":false,"digest":{"length":684,"function_hash":"14450297343088225418659765307324861358"},"id":"CVE-2026-44891-d6460f24"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/HttpContentEncoder.java","function":"decode"},"deprecated":false,"digest":{"function_hash":"159847160250759320602810083525322292892","length":655},"id":"CVE-2026-44891-d8a49be6"},{"id":"CVE-2026-44891-da25e09a","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-haproxy/src/test/java/io/netty/handler/codec/haproxy/HAProxyMessageDecoderTest.java"},"deprecated":false,"digest":{"line_hashes":["327029833501120662209868152744124089203","112835309588071539530671890227008312453","160200437653492181920062164065863339719"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"158286349469036580774923563317271823577","length":1533},"id":"CVE-2026-44891-da805efc","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker07.java","function":"newHandshakeResponse"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker08.java","function":"newHandshakeResponse"},"deprecated":false,"digest":{"function_hash":"175735896065295538372251057322078967917","length":1532},"id":"CVE-2026-44891-dc0f860f"},{"target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13.java","function":"newHandshakeResponse"},"deprecated":false,"digest":{"function_hash":"214217762640349105197563329908806953221","length":2010},"id":"CVE-2026-44891-dcaa8e7f","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"target":{"function":"HttpContentEncoder","file":"codec-http/src/main/java/io/netty/handler/codec/http/HttpContentEncoder.java"},"deprecated":false,"digest":{"function_hash":"270322437425350275442707701285844103065","length":58},"id":"CVE-2026-44891-dd01ba58","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"id":"CVE-2026-44891-dd2dcb87","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspHttpHandler.java","function":"channelRead0"},"deprecated":false,"digest":{"function_hash":"148769302880170977174187723693543641064","length":801}},{"target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeEncoder.java"},"deprecated":false,"digest":{"line_hashes":["320806806550674732028211844957798520210","190711259418488859151705856982185519946","40988646246908169270622596568547602459","178706763715060271344942711485006812441","217128450400286329523067573549556780935","163321098785654711277613671154013741862","116543323493668684840438152959966355785","314290275408126691495858304680249369747","210625495697437445527444585650503633847","163529220398439374285659324093620468204","240484561326370812979594440356692722432","37560835342479990086963836372925584401","75677433386161800134633019629943161450","113288905901856213136472137500769169375","58097051837636187984765689123320564669","163993406421282438060771717787043522798","227969836372584186705675248845497594873","38044790720616066487232267203651220114","306195453208815660459111540564041455909","52186497845284313153154135567748814990","228048871323674709010913896263197763684","245618107537130521762809742542770653643","175816424572933745928040402669909564138","293207869162228013358644318103651969392","252295007112226392396784237227959992237","331450265577643775425887136946579793174","110954995215833540033207126019749201480","257582701017251763685086933023665567452","254664894396716986499865816387509999280","335905733194747697429556302413647893656","138096167655618098180071181194675453638","35952787621064319778771278996351871625","215895075754588473378201177045153975767","127207673452762906211617431972815904085","127492926156995909706614872104250420029"],"threshold":0.9},"id":"CVE-2026-44891-ddd668cf","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"deprecated":false,"digest":{"length":992,"function_hash":"218822076986047941242336522899554650873"},"id":"CVE-2026-44891-de4cff98","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13Test.java","function":"testHandshakeExceptionWhenConnectionHeaderIsAbsent"}},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http2/src/main/java/io/netty/handler/codec/http2/DelegatingDecompressorFrameListener.java","function":"decompress"},"deprecated":false,"digest":{"function_hash":"30355876519965129833317156580072215067","length":693},"id":"CVE-2026-44891-e054d306","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker07.java"},"deprecated":false,"digest":{"line_hashes":["116821410237117041108277767088694593381","274457559659800330936849547928038705918","234639610510487449617634523480690234962","220831888384828359373456745614693019338"],"threshold":0.9},"id":"CVE-2026-44891-e2717866"},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspClient.java","function":"run"},"deprecated":false,"digest":{"length":1295,"function_hash":"228851702149180598658849682692851743736"},"id":"CVE-2026-44891-e2c0681f","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/test/java/io/netty/handler/codec/http3/Http3FrameCodecTest.java"},"deprecated":false,"digest":{"line_hashes":["332335526248626117625446513767521276809","13952467040913184682412065945677921479","198763088050828951921367421967146020634","39368273847359179742584135780416293777","86772181918573494634165874094899969715","80807939131774005283767113327592154377","3912006819702623569505120365132239139","232487975089166403213255387905409686789","97617747091706310810885837210056102326","116066440563361673333239423047111715506","90366397337200546353761874338995555"],"threshold":0.9},"id":"CVE-2026-44891-e30e4761","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-44891-e5c3786b","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec/src/test/java/io/netty/handler/codec/xml/XmlFrameDecoderTest.java"},"deprecated":false,"digest":{"line_hashes":["327158723351793588753640188077467485341","146637049070509916435609360486853342571","35224337321040372889677481702655949088","335376998431465025074804024510544983191","251090133384968034835274170030296466869","103759568539672511053292433675239569467","39857019549897038040177004091972883629","89510112780916572415402718496857975786","317289685401950499366496800087066653959"],"threshold":0.9}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-haproxy/src/test/java/io/netty/handler/codec/haproxy/HaProxyMessageEncoderTest.java"},"deprecated":false,"digest":{"line_hashes":["213001641769356484048488676129118987874","21925855898804535777340715217688183010","75743800141268020976889072350512137694","242979901231947713000954909566945864167","230344429068811301568411935303419277472","187273214625919887085102085762053239459","213029616262645006972529969959552494224"],"threshold":0.9},"id":"CVE-2026-44891-e5d586bb"},{"deprecated":false,"digest":{"function_hash":"70647407349868769204503066540447859707","length":1899},"id":"CVE-2026-44891-e83e3e01","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-xml/src/main/java/io/netty/handler/codec/xml/XmlFrameDecoder.java","function":"decode"}},{"deprecated":false,"digest":{"function_hash":"60411315538829935459783310606141971220","length":594},"id":"CVE-2026-44891-ea31eaef","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-stomp/src/main/java/io/netty/handler/codec/stomp/StompSubframeDecoder.java","function":"parseHeader"}},{"deprecated":false,"digest":{"line_hashes":["65870356287395881046061592624173766337","121170731949923739871338785327496385553","238358279677103295745229381741809390253","324530711068603710117506324225260147457"],"threshold":0.9},"id":"CVE-2026-44891-ed2d2ff9","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/test/java/io/netty/handler/codec/http3/Http3ServerConnectionHandlerTest.java"}},{"deprecated":false,"digest":{"line_hashes":["92307578025388777348656153027843725717","202016463117255771211198884405030283753","200002322802979857934563463776227725935","211739621856492752117528315763210616994","272814947343250035639939340202033124367","238639115832669564304637186337632408672","176615763682171961737415489928119070452","61257659008443162589687075419487494382","315071461160297541029213502906456347927","326969602072466906860174134051499186112"],"threshold":0.9},"id":"CVE-2026-44891-eddbfc17","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-compression/src/test/java/io/netty/handler/codec/compression/Bzip2DecoderTest.java"}},{"id":"CVE-2026-44891-ee37413c","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-dns/src/main/java/io/netty/handler/codec/dns/DefaultDnsRecordDecoder.java","function":"decodeRecord"},"deprecated":false,"digest":{"length":1142,"function_hash":"325156945155766697620025912436547709183"}},{"deprecated":false,"digest":{"function_hash":"104689743393881130937038172012160945675","length":555},"id":"CVE-2026-44891-ee899a61","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/test/java/io/netty/handler/codec/http3/Http3ClientConnectionHandlerTest.java","function":"customSensitivityDetectorIsForwardedToQpackEncoder"}},{"target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/HttpPostMultipartRequestDecoder.java","function":"cleanString"},"deprecated":false,"digest":{"function_hash":"10136683705229378616467463044735851786","length":536},"id":"CVE-2026-44891-efc47c2a","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b"},{"target":{"file":"codec-http2/src/test/java/io/netty/handler/codec/http2/HttpConversionUtilTest.java"},"deprecated":false,"digest":{"line_hashes":["16714536401088447436111609360693806903","125032373627195779714964835737054375337","96851361144117548187657929714803855685"],"threshold":0.9},"id":"CVE-2026-44891-f0b93d2d","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"deprecated":false,"digest":{"function_hash":"11783242442417011635617480254339845601","length":286},"id":"CVE-2026-44891-f0bce84f","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHeaderBlockZlibDecoder.java","function":"decode"}},{"digest":{"function_hash":"81918132740564498430408536384660959084","length":453},"id":"CVE-2026-44891-f1c94fe6","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3FrameCodec.java","function":"Http3FrameCodec"},"deprecated":false},{"digest":{"line_hashes":["139916686024033238243902984947301395555","250991380650454208151923893785427616327","240616680793929167471535691017128687242","32290217382679062830625500480833791923","59291249623847638559374159297552585304","118140941998078741400838418319585631251","94032339316722292590803560038599314290","152173007918338839052803546037346198166","119992178256019004500045985404749184740","171675770835867323990362733670210376571","284959972344057120467572102247075393743","110863273839120768077848144299029994795","263214326786697924053617218847691659412","76574190109574019744227510931009489425","316598199922350650181228404575767995260","44653109776843992506843428331238868694","225540191495412254989772525220692026568","245436530477811171891038100602633860607","108509864431443212906143840743211955382"],"threshold":0.9},"id":"CVE-2026-44891-f3cc03b6","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http3/src/main/java/io/netty/handler/codec/http3/Http3ConnectionHandler.java"},"deprecated":false},{"digest":{"line_hashes":["176776842045074526269533187815353173872","235025146080628010521672322610909598452","100826063227314915093477939577346625584"],"threshold":0.9},"id":"CVE-2026-44891-f5912148","signature_type":"Line","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/cors/CorsHandlerTest.java"},"deprecated":false},{"target":{"file":"codec-http/src/main/java/io/netty/handler/codec/spdy/SpdyHttpDecoder.java","function":"decode"},"deprecated":false,"digest":{"function_hash":"262016330598789818792568708104125130605","length":4465},"id":"CVE-2026-44891-f76faf20","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6"},{"signature_version":"v1","source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/test/java/io/netty/handler/codec/http/websocketx/WebSocketServerHandshaker13Test.java","function":"testHandshakeExceptionWhenInvalidUpgradeHeader"},"deprecated":false,"digest":{"function_hash":"20226002739668651510770811029403108866","length":1054},"id":"CVE-2026-44891-fb12a355","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"64853882235254194606912722654113817163","length":1765},"id":"CVE-2026-44891-fe089a00","signature_type":"Function","signature_version":"v1","source":"https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6","target":{"file":"handler-ssl-ocsp/src/main/java/io/netty/handler/ssl/ocsp/OcspServerCertificateValidator.java","function":"userEventTriggered"}},{"source":"https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b","target":{"file":"codec-http/src/main/java/io/netty/handler/codec/http/multipart/FileUploadUtil.java"},"deprecated":false,"digest":{"line_hashes":["85269044829674307358000079209799629337","79336017118920939603572992123962365933","304403807524013726629156840792486146913"],"threshold":0.9},"id":"CVE-2026-44891-ff5e407f","signature_type":"Line","signature_version":"v1"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}