VulnerableCode Package Details - pkg:maven/io.netty/netty-all@4.0.40.Final

Search for packages

Advisory	Summary	Fixed in package version
CVE-2021-21290	Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. …	4.1.59.Final Vulnerable
CVE-2020-11612	The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker …	4.1.46.Final Vulnerable 4.1.48.Final Vulnerable 4.1.49.Final Vulnerable 4.1.50.Final Vulnerable 4.1.51.Final Vulnerable
CVE-2020-7238	Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length …	4.1.44.Final Vulnerable 4.1.45.Final Vulnerable
CVE-2019-20445	HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a …	4.1.44.Final Vulnerable 4.1.45.Final Vulnerable
CVE-2019-16869	Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads …	4.1.42.Final Vulnerable 4.1.43.Final Vulnerable 4.1.45.Final Vulnerable
CVE-2021-21409 Aliases: GHSA-f256-j965-7f32 GHSA-wm47-8v5p-wjpj	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development …	4.1.61.Final Vulnerable
CVE-2021-37136 Aliases: GHSA-grg4-wf29-r9vv	Uncontrolled Resource Consumption The Bzip2 decompression decoder function does not allow setting size restrictions on the decompressed output data (which …	There are no reported fixed by versions.
CVE-2022-41881 Aliases: GHSA-fx2c-96vj-985v	Uncontrolled Recursion Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be …	There are no reported fixed by versions.
GHSA-p979-4mfw-53vg Aliases: CVE-2019-16869	HTTP Request Smuggling in Netty Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding …	4.1.42.Final Vulnerable 4.1.42.Final Vulnerable
CVE-2019-16869 Aliases: GHSA-p979-4mfw-53vg	HTTP Request Smuggling in Netty Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding …	There are no reported fixed by versions.
CVE-2023-34462 Aliases: GHSA-6mjq-h674-j845	Allocation of Resources Without Limits or Throttling Netty is an asynchronous event-driven network application framework for rapid development of maintainable …	4.1.94.Final Not vulnerable 4.1.94.Final Not vulnerable
CVE-2026-93565 Aliases: GHSA-h75q-xqrh-59rf	Incorrect Behavior Order: Validate Before Canonicalize A flaw was found in Netty `RtspDecoder`. The `RtspMethods.valueOf()` function incorrectly strips trailing control …	There are no reported fixed by versions.
CVE-2026-93569 Aliases: GHSA-cg2g-fxr4-mg8m	Inconsistent Interpretation of HTTP Requests A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in …	There are no reported fixed by versions.
CVE-2026-93567 Aliases: GHSA-45h4-vhwh-fmhg	Improper Input Validation A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component …	There are no reported fixed by versions.
CVE-2026-100666 Aliases: GHSA-2g6j-r8q9-5hr8	Inconsistent Interpretation of HTTP Requests Netty's `HttpServerCodec` pairs each outbound response with an inbound request by calling `pollMethod()` once per …	There are no reported fixed by versions.

Advisory

Summary

Fixed in package version

CVE-2021-21290

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. …

4.1.59.Final
Vulnerable

CVE-2020-11612

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker …

4.1.46.Final
Vulnerable

4.1.48.Final
Vulnerable

4.1.49.Final
Vulnerable

4.1.50.Final
Vulnerable

4.1.51.Final
Vulnerable

CVE-2020-7238

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length …

4.1.44.Final
Vulnerable

4.1.45.Final
Vulnerable

CVE-2019-20445

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a …

4.1.44.Final
Vulnerable

4.1.45.Final
Vulnerable

CVE-2019-16869

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads …

4.1.42.Final
Vulnerable

4.1.43.Final
Vulnerable

4.1.45.Final
Vulnerable

CVE-2021-21409
Aliases:
GHSA-f256-j965-7f32
GHSA-wm47-8v5p-wjpj

Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development …

4.1.61.Final
Vulnerable

CVE-2021-37136
Aliases:
GHSA-grg4-wf29-r9vv

Uncontrolled Resource Consumption The Bzip2 decompression decoder function does not allow setting size restrictions on the decompressed output data (which …