Search for packages
| purl | pkg:maven/io.netty/netty-all@4.0.26.Final |
| Next non-vulnerable version | 4.1.94.Final |
| Latest non-vulnerable version | 4.1.94.Final |
| Risk score | 3.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2015-2156
|
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2016-4970
|
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-11612
|
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-7238
|
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length … |
Vulnerable Vulnerable |
|
CVE-2019-20445
|
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a … |
Vulnerable Vulnerable |
|
CVE-2019-16869
|
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-21409
Aliases: GHSA-f256-j965-7f32 GHSA-wm47-8v5p-wjpj |
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development … |
Vulnerable |
|
CVE-2021-37136
Aliases: GHSA-grg4-wf29-r9vv |
Uncontrolled Resource Consumption The Bzip2 decompression decoder function does not allow setting size restrictions on the decompressed output data (which … | There are no reported fixed by versions. |
|
CVE-2022-41881
Aliases: GHSA-fx2c-96vj-985v |
Uncontrolled Recursion Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be … | There are no reported fixed by versions. |
|
GHSA-p979-4mfw-53vg
Aliases: CVE-2019-16869 |
HTTP Request Smuggling in Netty Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding … |
Vulnerable Vulnerable |
|
CVE-2019-16869
Aliases: GHSA-p979-4mfw-53vg |
HTTP Request Smuggling in Netty Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding … | There are no reported fixed by versions. |
|
CVE-2023-34462
Aliases: GHSA-6mjq-h674-j845 |
Allocation of Resources Without Limits or Throttling Netty is an asynchronous event-driven network application framework for rapid development of maintainable … |
Not vulnerable Not vulnerable |
|
CVE-2026-93565
Aliases: GHSA-h75q-xqrh-59rf |
Incorrect Behavior Order: Validate Before Canonicalize A flaw was found in Netty `RtspDecoder`. The `RtspMethods.valueOf()` function incorrectly strips trailing control … | There are no reported fixed by versions. |
|
CVE-2026-93569
Aliases: GHSA-cg2g-fxr4-mg8m |
Inconsistent Interpretation of HTTP Requests A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in … | There are no reported fixed by versions. |
|
CVE-2026-93567
Aliases: GHSA-45h4-vhwh-fmhg |
Improper Input Validation A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component … | There are no reported fixed by versions. |
|
CVE-2026-100666
Aliases: GHSA-2g6j-r8q9-5hr8 |
Inconsistent Interpretation of HTTP Requests Netty's `HttpServerCodec` pairs each outbound response with an inbound request by calling `pollMethod()` once per … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2014-0193
|
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows … |