Netty - vulnerabilities (CVEs)

115 CVEs in 6 products, 4 in the last 30 days, newest from 2026-10-26.

Products

Netty - 102 CVEs
Netty-incubator-codec-ohttp - 6 CVEs
Netty-tcnative - 4 CVEs
Netty-tcnative-boringssl-static - 3 CVEs
Io.nettynetty-codec-http2 - 1 CVEs
Netty-incubator-codec-quic - 1 CVEs

Newest CVEs of Netty

CVE-2026-116542 - CVSS 6.9 (medium), 2026-10-26: Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI…
CVE-2026-116540 - CVSS 8.2 (high), 2026-10-26: netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session…
CVE-2026-116541 - CVSS 8.2 (high), 2026-10-26: Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes…
CVE-2026-116539 - CVSS 8.2 (high), 2026-10-26: Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap…
CVE-2026-100665 - CVSS 8.7 (high), 2026-09-26: Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a…
CVE-2026-100666 - CVSS 7.3 (high), 2026-09-26: Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each…
CVE-2026-100664 - CVSS 8.7 (high), 2026-09-26: Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host…
CVE-2026-100663 - CVSS 8.7 (high), 2026-09-26: Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets…
CVE-2026-100662 - CVSS 8.7 (high), 2026-09-26: Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the…
CVE-2026-100661 - CVSS 8.7 (high), 2026-09-26: Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK…
CVE-2026-100660 - CVSS 8.7 (high), 2026-09-26: Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores…
CVE-2026-100659 - CVSS 6.9 (medium), 2026-09-26: Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority…
CVE-2026-54251 - CVSS 8.7 (high), 2026-09-15: netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty. Prior to 0.0.23.Final, the OHTTP gateway…
CVE-2026-89044 - CVSS 6.9 (medium), 2026-09-10: Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the…
CVE-2026-76816 - CVSS 3.5 (low), 2026-08-24: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client…
CVE-2026-62243 - CVSS 8.7 (high), 2026-08-22: Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the…
CVE-2026-62380 - CVSS 7.5 (high), 2026-08-22: Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection…
CVE-2026-75595 - CVSS 9.1 (critical), 2026-08-19: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final,…
CVE-2026-75596 - CVSS 8.7 (high), 2026-08-19: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler…
CVE-2026-59903 - CVSS 7.5 (high), 2026-08-17: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler…
CVE-2026-59902 - CVSS 7.5 (high), 2026-08-17: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final,…
CVE-2026-73508 - CVSS 7.5 (high), 2026-08-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord,…
CVE-2026-73507 - CVSS 7.5 (high), 2026-08-13: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final,…
CVE-2026-56818 - CVSS 6.5 (medium), 2026-08-07: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears…
CVE-2026-59898 - CVSS 7.5 (high), 2026-07-29: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket…
CVE-2026-59899 - CVSS 7.5 (high), 2026-07-29: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass…
CVE-2026-59900 - CVSS 6.9 (medium), 2026-07-29: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation…
CVE-2026-59901 - CVSS 8.7 (high), 2026-07-29: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's…
CVE-2026-59919 - CVSS 5.5 (medium), 2026-07-29: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder…
CVE-2026-59920 - CVSS 6.5 (medium), 2026-07-29: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder…