VulnerableCode Package Details - pkg:maven/io.netty/netty-codec-http2@4.1.38.Final

Vulnerabilities affecting this package (26)

Advisory	Summary	Fixed in package version
CVE-2019-9515	Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a …	4.1.39.Final Vulnerable 4.1.41.Final Vulnerable 4.1.42.Final Vulnerable 4.1.43.Final Vulnerable 4.1.44.Final Vulnerable 4.1.45.Final Vulnerable 4.1.46.Final Vulnerable 4.1.47.Final Vulnerable 4.1.48.Final Vulnerable 4.1.49.Final Vulnerable 4.1.50.Final Vulnerable 4.1.51.Final Vulnerable
CVE-2019-9512	Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings …	4.1.39.Final Vulnerable 4.1.41.Final Vulnerable 4.1.42.Final Vulnerable 4.1.43.Final Vulnerable 4.1.44.Final Vulnerable 4.1.45.Final Vulnerable 4.1.46.Final Vulnerable 4.1.47.Final Vulnerable 4.1.48.Final Vulnerable 4.1.49.Final Vulnerable 4.1.50.Final Vulnerable 4.1.51.Final Vulnerable
CVE-2019-9514	Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a …	4.1.39.Final Vulnerable 4.1.41.Final Vulnerable 4.1.42.Final Vulnerable 4.1.43.Final Vulnerable 4.1.44.Final Vulnerable 4.1.45.Final Vulnerable 4.1.46.Final Vulnerable 4.1.47.Final Vulnerable 4.1.48.Final Vulnerable 4.1.49.Final Vulnerable 4.1.50.Final Vulnerable 4.1.51.Final Vulnerable
CVE-2019-9518	Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker …	4.1.39.Final Vulnerable 4.1.41.Final Vulnerable 4.1.42.Final Vulnerable 4.1.44.Final Vulnerable 4.1.45.Final Vulnerable
GHSA-xpw8-rcwv-8f8p Aliases: CVE-2023-44487 GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg	io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack A client might overload the server by issue frequent RST frames. This can …	4.1.100.Final Vulnerable
CVE-2021-21409 Aliases: GHSA-f256-j965-7f32	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development …	4.1.61.Final Vulnerable
CVE-2020-11612	Uncontrolled Resource Consumption The ZlibDecoders in Netty allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker …	4.1.46.Final Vulnerable
CVE-2026-42587 Aliases: GHSA-f6hv-jmp6-3vwv	Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to …	There are no reported fixed by versions.
CVE-2026-47244 Aliases: GHSA-5x3r-wrvg-rp6q	Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 …	There are no reported fixed by versions.
CVE-2026-50560 Aliases: GHSA-563q-j3cm-6jxm	Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature Netty HTTP/2 max header size handling produces attack similar to …	There are no reported fixed by versions.
CVE-2021-21295 Aliases: GHSA-wm47-8v5p-wjpj	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) If a `Content-Length` header is present in the original `HTTP/2` request, the …	4.1.60.Final Vulnerable 4.1.60.Final Vulnerable
CVE-2026-59900 Aliases: GHSA-c69g-56f8-xwqj	Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` …	There are no reported fixed by versions.
CVE-2026-56819 Aliases: GHSA-93wv-jw9v-4972	Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) …	There are no reported fixed by versions.
GHSA-f256-j965-7f32 Aliases: CVE-2021-21409	Possible request smuggling in HTTP/2 due missing validation of content-length ### Impact The content-length header is not correctly validated if …	4.1.61.Final Vulnerable 4.1.61.Final Vulnerable
GHSA-wm47-8v5p-wjpj Aliases: CVE-2021-21295	Possible request smuggling in HTTP/2 due missing validation ### Impact If a Content-Length header is present in the original HTTP/2 …	4.1.60.Final Vulnerable 4.1.60.Final Vulnerable
GHSA-prj3-ccx8-p6x4 Aliases: CVE-2025-55163	Netty affected by MadeYouReset HTTP/2 DDoS vulnerability Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which …	4.2.4.Final Vulnerable 4.1.124.Final Vulnerable 4.1.124.Final Vulnerable
GHSA-5x3r-wrvg-rp6q Aliases: CVE-2026-47244	Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced ### Impact DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by …	4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-563q-j3cm-6jxm Aliases: CVE-2026-50560	Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature ### Summary Netty HTTP/2 max header size handling produces attack …	4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-c2gf-v879-257j Aliases: CVE-2026-48043	netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion ### Impact The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding …	4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.2.15.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-f6hv-jmp6-3vwv Aliases: CVE-2026-42587	Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS ## Summary `HttpContentDecompressor` accepts a `maxAllocation` …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-c69g-56f8-xwqj Aliases: CVE-2026-59900	Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-93wv-jw9v-4972 Aliases: CVE-2026-56819	Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-w9fj-cfpg-grvv Aliases: CVE-2026-33871	Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass ### Summary A remote user can trigger a Denial of …	4.1.132.Final Vulnerable 4.2.11.Final Vulnerable 4.1.132.Final Vulnerable
CVE-2026-48043 Aliases: GHSA-c2gf-v879-257j	netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream …	There are no reported fixed by versions.
CVE-2026-93569 Aliases: GHSA-cg2g-fxr4-mg8m	Inconsistent Interpretation of HTTP Requests A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in …	There are no reported fixed by versions.
CVE-2026-93567 Aliases: GHSA-45h4-vhwh-fmhg	Improper Input Validation A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	3.9