VulnerableCode Package Details - pkg:maven/io.netty/netty-codec-http2@4.1.0.Beta5

Vulnerabilities affecting this package (17)

Advisory	Summary	Fixed in package version
GHSA-xpw8-rcwv-8f8p Aliases: CVE-2023-44487 GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg	io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack A client might overload the server by issue frequent RST frames. This can …	4.1.100.Final Vulnerable
CVE-2021-21409 Aliases: GHSA-f256-j965-7f32	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development …	4.1.61.Final Vulnerable
CVE-2026-42587 Aliases: GHSA-f6hv-jmp6-3vwv	Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to …	There are no reported fixed by versions.
CVE-2026-47244 Aliases: GHSA-5x3r-wrvg-rp6q	Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 …	There are no reported fixed by versions.
CVE-2026-50560 Aliases: GHSA-563q-j3cm-6jxm	Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature Netty HTTP/2 max header size handling produces attack similar to …	There are no reported fixed by versions.
CVE-2021-21295 Aliases: GHSA-wm47-8v5p-wjpj	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) If a `Content-Length` header is present in the original `HTTP/2` request, the …	4.1.60.Final Vulnerable 4.1.60.Final Vulnerable
CVE-2026-59900 Aliases: GHSA-c69g-56f8-xwqj	Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` …	There are no reported fixed by versions.
GHSA-f256-j965-7f32 Aliases: CVE-2021-21409	Possible request smuggling in HTTP/2 due missing validation of content-length ### Impact The content-length header is not correctly validated if …	4.1.61.Final Vulnerable 4.1.61.Final Vulnerable
GHSA-wm47-8v5p-wjpj Aliases: CVE-2021-21295	Possible request smuggling in HTTP/2 due missing validation ### Impact If a Content-Length header is present in the original HTTP/2 …	4.1.60.Final Vulnerable 4.1.60.Final Vulnerable
GHSA-prj3-ccx8-p6x4 Aliases: CVE-2025-55163	Netty affected by MadeYouReset HTTP/2 DDoS vulnerability Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which …	4.2.4.Final Vulnerable 4.1.124.Final Vulnerable 4.1.124.Final Vulnerable
GHSA-5x3r-wrvg-rp6q Aliases: CVE-2026-47244	Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced ### Impact DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by …	4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-563q-j3cm-6jxm Aliases: CVE-2026-50560	Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature ### Summary Netty HTTP/2 max header size handling produces attack …	4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-c2gf-v879-257j Aliases: CVE-2026-48043	netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion ### Impact The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding …	4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-f6hv-jmp6-3vwv Aliases: CVE-2026-42587	Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS ## Summary `HttpContentDecompressor` accepts a `maxAllocation` …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-c69g-56f8-xwqj Aliases: CVE-2026-59900	Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-w9fj-cfpg-grvv Aliases: CVE-2026-33871	Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass ### Summary A remote user can trigger a Denial of …	4.1.132.Final Vulnerable 4.2.11.Final Vulnerable 4.1.132.Final Vulnerable
CVE-2026-48043 Aliases: GHSA-c2gf-v879-257j	netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	3.9