Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/io.netty/netty-codec-http2@4.1.135
purl pkg:maven/io.netty/netty-codec-http2@4.1.135
Tags Ghost
This package is not known to be subject of any advisories.
Vulnerabilities fixed by this package (3)

Advisory Summary Aliases
CVE-2026-47244
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 … GHSA-5x3r-wrvg-rp6q
CVE-2026-50560
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature Netty HTTP/2 max header size handling produces attack similar to … GHSA-563q-j3cm-6jxm
CVE-2026-48043
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream … GHSA-c2gf-v879-257j