Search for packages
| purl | pkg:maven/io.netty/netty-all@4.1.46.Final |
| Next non-vulnerable version | 4.1.94.Final |
| Latest non-vulnerable version | 4.1.94.Final |
| Risk score |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2021-21290
|
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. … |
Vulnerable |
|
CVE-2021-21409
Aliases: GHSA-f256-j965-7f32 GHSA-wm47-8v5p-wjpj |
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development … |
Vulnerable |
|
CVE-2021-37136
Aliases: GHSA-grg4-wf29-r9vv |
Uncontrolled Resource Consumption The Bzip2 decompression decoder function does not allow setting size restrictions on the decompressed output data (which … | There are no reported fixed by versions. |
|
CVE-2022-41881
Aliases: GHSA-fx2c-96vj-985v |
Uncontrolled Recursion Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be … | There are no reported fixed by versions. |
|
CVE-2023-34462
Aliases: GHSA-6mjq-h674-j845 |
Allocation of Resources Without Limits or Throttling Netty is an asynchronous event-driven network application framework for rapid development of maintainable … |
Not vulnerable Not vulnerable |
|
CVE-2026-62243
Aliases: GHSA-p85m-gvr3-788c |
Improper Validation of Certificate with Host Mismatch Netty disables TLS hostname verification on the `SslProvider.OPENSSL` client path when a plain … | There are no reported fixed by versions. |
|
CVE-2026-93565
Aliases: GHSA-h75q-xqrh-59rf |
Incorrect Behavior Order: Validate Before Canonicalize A flaw was found in Netty `RtspDecoder`. The `RtspMethods.valueOf()` function incorrectly strips trailing control … | There are no reported fixed by versions. |
|
CVE-2026-93569
Aliases: GHSA-cg2g-fxr4-mg8m |
Inconsistent Interpretation of HTTP Requests A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in … | There are no reported fixed by versions. |
|
CVE-2026-93567
Aliases: GHSA-45h4-vhwh-fmhg |
Improper Input Validation A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component … | There are no reported fixed by versions. |
|
CVE-2026-100666
Aliases: GHSA-2g6j-r8q9-5hr8 |
Inconsistent Interpretation of HTTP Requests Netty's `HttpServerCodec` pairs each outbound response with an inbound request by calling `pollMethod()` once per … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2019-9515
|
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a … | |
|
CVE-2015-2156
|
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might … | |
|
CVE-2019-9512
|
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings … | |
|
CVE-2020-11612
|
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker … | |
|
CVE-2014-0193
|
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows … | |
|
CVE-2019-9514
|
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a … |