HCL BigFix Remote Control Vulnerabilities: CVE-2026-33870/33871 Advisory

Vulnerability Overview HCL BigFix Remote Control is affected by multiple security vulnerabilities, specifically: 1. CVE-2026-33870: Inconsistent Interpretation of HTTP Requests 2. CVE-2026-33871: Allocation of Resources Without Limits or Throttle 3. CVE-2026-21785: Failure to Define Directive with No Fallback Affected Versions CVE-2026-33870: - Affected Versions: HCL BigFix Remote Control versions 10.1.0.442 and earlier - Component: BigFix Remote Control Server CVE-2026-33871: - Affected Versions: HCL BigFix Remote Control versions 4.1.132.Final and 4.2.10.Final and earlier - Component: BigFix Remote Control Server Remediation CVE-2026-33870: - Fixed Versions: 4.1.132.Final and 4.2.10.Final CVE-2026-33871: - Fixed Versions: 4.1.132.Final and 4.2.10.Final Details CVE-2026-33870 Description: Netty is an asynchronous event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parsed the frame in HTTP requests, leading to HTTP request smuggling attacks. CVSS Base Score: 7.5 - High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVE-2026-33871 Description: Netty is an asynchronous event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, remote attackers could trigger excessive CPU consumption on the BigFix Remote Control server by sending a large number of frames, resulting in a denial of service (DoS) attack. CVSS Base Score: 7.5 - High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Summary HCL BigFix Remote Control contains multiple security vulnerabilities affecting specific product versions. Users are advised to upgrade to the fixed versions as soon as possible to eliminate potential risks.

Goal Reached Thanks to every supporter — we hit 100%!

HCL BigFix Remote Control Vulnerabilities: CVE-2026-33870/33871 Advisory

More from this source