Search for packages
| purl | pkg:maven/io.netty/netty-handler@4.2.15.Final |
| Next non-vulnerable version | 4.2.17.Final |
| Latest non-vulnerable version | 4.2.17.Final |
| Risk score | 4.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-fccg-mwvh-qqg4
Aliases: CVE-2026-75596 |
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing ### Summary Netty's default SNI entrypoint reparses and … |
Not vulnerable Not vulnerable |
|
GHSA-c4c3-7fpv-j4q5
Aliases: CVE-2026-75595 |
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext ### Summary A fragmented TLS ClientHello whose … |
Not vulnerable Not vulnerable |
|
CVE-2026-75596
Aliases: GHSA-fccg-mwvh-qqg4 |
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing Netty's default SNI entrypoint reparses and recopies previously … | There are no reported fixed by versions. |
|
CVE-2026-75595
Aliases: GHSA-c4c3-7fpv-j4q5 |
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext A fragmented TLS ClientHello whose handshake header … | There are no reported fixed by versions. |
|
CVE-2026-62243
Aliases: GHSA-p85m-gvr3-788c |
Improper Validation of Certificate with Host Mismatch Netty disables TLS hostname verification on the `SslProvider.OPENSSL` client path when a plain … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-c653-97m9-rcg9
|
Netty: Wrapping plain trust manager silently disables hostname verification SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, … |
CVE-2026-50010
|
|
GHSA-x4gw-5cx5-pgmh
|
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, … |
CVE-2026-45416
|
|
GHSA-3qp7-7mw8-wx86
|
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking ### Summary An attacker can bypass IPv6 subnet rules … |
CVE-2026-44249
|