Search for packages
| purl | pkg:maven/io.netty/netty-codec-http@4.1.136.Final |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8c42-7qj2-3j46
Aliases: CVE-2026-59903 |
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite ### Summary Netty's `CorsHandler` silently overwrites existing … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-59903
Aliases: GHSA-8c42-7qj2-3j46 |
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite Netty's `CorsHandler` silently overwrites existing `Vary` headers, … | There are no reported fixed by versions. |
|
CVE-2026-93565
Aliases: GHSA-h75q-xqrh-59rf |
Incorrect Behavior Order: Validate Before Canonicalize A flaw was found in Netty `RtspDecoder`. The `RtspMethods.valueOf()` function incorrectly strips trailing control … | There are no reported fixed by versions. |
|
CVE-2026-93558
Aliases: GHSA-2g37-3h88-55hc |
Uncontrolled Resource Consumption A flaw was found in Netty's `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit this vulnerability by using … | There are no reported fixed by versions. |
|
CVE-2026-100666
Aliases: GHSA-2g6j-r8q9-5hr8 |
Inconsistent Interpretation of HTTP Requests Netty's `HttpServerCodec` pairs each outbound response with an inbound request by calling `pollMethod()` once per … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-gcjf-9mgh-3p7g
|
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder # Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty … |
CVE-2026-59921
|
|
GHSA-6cqp-g7gg-8hr5
|
Netty: Security Control Bypass via CORS Short-Circuit Failure ### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized … |
CVE-2026-56746
|
|
GHSA-mvh2-crg5-v77c
|
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation ### Summary Netty SPDY header decoding continues inflating zlib-compressed … |
CVE-2026-55833
|
|
GHSA-6jqx-86gh-f27w
|
Netty SPDY SETTINGS frame count materializes unbounded settings map ### Summary Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry … |
CVE-2026-55831
|
|
GHSA-q4f6-jm68-57ww
|
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service ### Impact `HttpContentEncoder` (the superclass of … |
CVE-2026-59899
|
|
GHSA-4mp9-239f-g9hg
|
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation ## Summary An attacker can force WebSocket upgrade via the lax V07 (or … |
CVE-2026-59898
|
|
GHSA-jppx-w49h-x2qq
|
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates … |
CVE-2026-56745
|