VulnerableCode Package Details - pkg:maven/io.netty/netty@3.6.8.Final

Search for packages

Package details: pkg:maven/io.netty/netty@3.6.8.Final

Essentials
History (4)

purl	pkg:maven/io.netty/netty@3.6.8.Final

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	4.5

Vulnerabilities affecting this package (4)

Vulnerability	Summary	Fixed by
VCID-es3s-xjbh-wbas Aliases: CVE-2015-2156 GHSA-xfv3-rrfm-f2rv	Information Exposure in Netty Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.	3.9.8.Final Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.10.3.Final Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-fm8k-swyd-3fbc Aliases: CVE-2019-20444 GHSA-cqqj-4p63-rrmm	HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."	4.0.0 Affected by 0 other vulnerabilities.
VCID-pea1-uju4-myaa Aliases: CVE-2014-0193 GHSA-7vpq-g998-qpv7		3.6.9 Affected by 0 other vulnerabilities. 3.6.9.Final Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.7.1 Affected by 0 other vulnerabilities. 3.7.1.Final Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.8.2 Affected by 0 other vulnerabilities. 3.8.2.Final Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.9.1 Affected by 0 other vulnerabilities. 3.9.1.Final Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 4.0.19.Final Affected by 0 other vulnerabilities. 4.0.19 Affected by 0 other vulnerabilities.
VCID-sf1p-fp2z-bkb6 Aliases: CVE-2019-20445 GHSA-p2v9-g2qv-p635	HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.	4.0.0 Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-03T18:15:59.260722+00:00	GitLab Importer	Affected by	VCID-pea1-uju4-myaa	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/io.netty/netty/CVE-2014-0193.yml	37.0.0
2025-07-03T17:42:08.685459+00:00	GitLab Importer	Affected by	VCID-es3s-xjbh-wbas	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/io.netty/netty/CVE-2015-2156.yml	37.0.0
2025-07-03T17:38:55.765327+00:00	GitLab Importer	Affected by	VCID-fm8k-swyd-3fbc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/io.netty/netty/CVE-2019-20444.yml	37.0.0
2025-07-03T17:38:55.202209+00:00	GitLab Importer	Affected by	VCID-sf1p-fp2z-bkb6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/io.netty/netty/CVE-2019-20445.yml	37.0.0