Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/io.netty/netty-codec-http2@4.1.136.Final
purl pkg:maven/io.netty/netty-codec-http2@4.1.136.Final
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 3.9
Vulnerabilities affecting this package (3)
Advisory Summary Fixed in package version
CVE-2026-93569
Aliases:
GHSA-cg2g-fxr4-mg8m
Inconsistent Interpretation of HTTP Requests A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in … There are no reported fixed by versions.
CVE-2026-93568
Aliases:
GHSA-w6j8-x45j-w75f
Improper Input Validation A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted … There are no reported fixed by versions.
CVE-2026-93567
Aliases:
GHSA-45h4-vhwh-fmhg
Improper Input Validation A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component … There are no reported fixed by versions.
Vulnerabilities fixed by this package (2)

Advisory Summary Aliases
GHSA-c69g-56f8-xwqj
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` … CVE-2026-59900
GHSA-93wv-jw9v-4972
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) … CVE-2026-56819