Search for packages
| purl | pkg:maven/io.netty/netty-codec-http2@4.1.106.Final |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2026-42587
Aliases: GHSA-f6hv-jmp6-3vwv |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to … | There are no reported fixed by versions. |
|
CVE-2026-47244
Aliases: GHSA-5x3r-wrvg-rp6q |
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 … | There are no reported fixed by versions. |
|
CVE-2026-50560
Aliases: GHSA-563q-j3cm-6jxm |
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature Netty HTTP/2 max header size handling produces attack similar to … | There are no reported fixed by versions. |
|
CVE-2026-59900
Aliases: GHSA-c69g-56f8-xwqj |
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` … | There are no reported fixed by versions. |
|
CVE-2026-56819
Aliases: GHSA-93wv-jw9v-4972 |
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) … | There are no reported fixed by versions. |
|
GHSA-prj3-ccx8-p6x4
Aliases: CVE-2025-55163 |
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-5x3r-wrvg-rp6q
Aliases: CVE-2026-47244 |
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced ### Impact DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-563q-j3cm-6jxm
Aliases: CVE-2026-50560 |
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature ### Summary Netty HTTP/2 max header size handling produces attack … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-c2gf-v879-257j
Aliases: CVE-2026-48043 |
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion ### Impact The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-f6hv-jmp6-3vwv
Aliases: CVE-2026-42587 |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS ## Summary `HttpContentDecompressor` accepts a `maxAllocation` … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-c69g-56f8-xwqj
Aliases: CVE-2026-59900 |
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-93wv-jw9v-4972
Aliases: CVE-2026-56819 |
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-w9fj-cfpg-grvv
Aliases: CVE-2026-33871 |
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass ### Summary A remote user can trigger a Denial of … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-48043
Aliases: GHSA-c2gf-v879-257j |
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream … | There are no reported fixed by versions. |
|
CVE-2026-93569
Aliases: GHSA-cg2g-fxr4-mg8m |
Inconsistent Interpretation of HTTP Requests A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in … | There are no reported fixed by versions. |
|
CVE-2026-93568
Aliases: GHSA-w6j8-x45j-w75f |
Improper Input Validation A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted … | There are no reported fixed by versions. |
|
CVE-2026-93567
Aliases: GHSA-45h4-vhwh-fmhg |
Improper Input Validation A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component … | There are no reported fixed by versions. |