Search for packages
| purl | pkg:maven/io.netty/netty-handler@4.1.94.Final |
| Next non-vulnerable version | 4.1.137.Final |
| Latest non-vulnerable version | 4.2.17.Final |
| Risk score | 4.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-57m8-f3v5-hm5m
Aliases: CVE-2023-4586 |
Withdrawn Advisory: Netty-handler does not validate host names by default ## Withdrawn Advisory This advisory has been withdrawn because the … | There are no reported fixed by versions. |
|
GHSA-c653-97m9-rcg9
Aliases: CVE-2026-50010 |
Netty: Wrapping plain trust manager silently disables hostname verification SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, … |
Vulnerable |
|
CVE-2026-45416
Aliases: GHSA-x4gw-5cx5-pgmh |
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, … | There are no reported fixed by versions. |
|
CVE-2026-44249
Aliases: GHSA-3qp7-7mw8-wx86 |
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking An attacker can bypass IPv6 subnet rules due to … | There are no reported fixed by versions. |
|
CVE-2026-50010
Aliases: GHSA-c653-97m9-rcg9 |
Netty: Wrapping plain trust manager silently disables hostname verification SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, … | There are no reported fixed by versions. |
|
GHSA-4g8c-wm8x-jfhw
Aliases: CVE-2025-24970 |
SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine ### Impact When a special … |
Vulnerable Vulnerable |
|
GHSA-x4gw-5cx5-pgmh
Aliases: CVE-2026-45416 |
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-3qp7-7mw8-wx86
Aliases: CVE-2026-44249 |
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking ### Summary An attacker can bypass IPv6 subnet rules … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-fccg-mwvh-qqg4
Aliases: CVE-2026-75596 |
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing ### Summary Netty's default SNI entrypoint reparses and … |
Not vulnerable Not vulnerable Not vulnerable |
|
GHSA-c4c3-7fpv-j4q5
Aliases: CVE-2026-75595 |
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext ### Summary A fragmented TLS ClientHello whose … |
Not vulnerable Not vulnerable Not vulnerable |
|
CVE-2026-75596
Aliases: GHSA-fccg-mwvh-qqg4 |
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing Netty's default SNI entrypoint reparses and recopies previously … | There are no reported fixed by versions. |
|
CVE-2026-75595
Aliases: GHSA-c4c3-7fpv-j4q5 |
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext A fragmented TLS ClientHello whose handshake header … | There are no reported fixed by versions. |
|
CVE-2026-62243
Aliases: GHSA-p85m-gvr3-788c |
Improper Validation of Certificate with Host Mismatch Netty disables TLS hostname verification on the `SslProvider.OPENSSL` client path when a plain … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-6mjq-h674-j845
|
netty-handler SniHandler 16MB allocation ### Summary The `SniHandler` can allocate up to 16MB of heap for each channel during the … |
CVE-2023-34462
|