Search for packages
| purl | pkg:maven/io.netty/netty-codec-http2@4.1.58.Final |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-xpw8-rcwv-8f8p
Aliases: CVE-2023-44487 GHSA-2m7v-gc89-fjqf GHSA-qppj-fm5r-hxr3 GHSA-vx74-f528-fxqg |
io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack A client might overload the server by issue frequent RST frames. This can … |
Vulnerable |
|
CVE-2021-21409
Aliases: GHSA-f256-j965-7f32 |
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development … |
Vulnerable |
|
CVE-2026-42587
Aliases: GHSA-f6hv-jmp6-3vwv |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to … | There are no reported fixed by versions. |
|
CVE-2026-47244
Aliases: GHSA-5x3r-wrvg-rp6q |
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 … | There are no reported fixed by versions. |
|
CVE-2026-50560
Aliases: GHSA-563q-j3cm-6jxm |
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature Netty HTTP/2 max header size handling produces attack similar to … | There are no reported fixed by versions. |
|
CVE-2021-21295
Aliases: GHSA-wm47-8v5p-wjpj |
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) If a `Content-Length` header is present in the original `HTTP/2` request, the … |
Vulnerable Vulnerable |
|
CVE-2026-59900
Aliases: GHSA-c69g-56f8-xwqj |
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` … | There are no reported fixed by versions. |
|
CVE-2026-56819
Aliases: GHSA-93wv-jw9v-4972 |
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) … | There are no reported fixed by versions. |
|
GHSA-f256-j965-7f32
Aliases: CVE-2021-21409 |
Possible request smuggling in HTTP/2 due missing validation of content-length ### Impact The content-length header is not correctly validated if … |
Vulnerable Vulnerable |
|
GHSA-wm47-8v5p-wjpj
Aliases: CVE-2021-21295 |
Possible request smuggling in HTTP/2 due missing validation ### Impact If a Content-Length header is present in the original HTTP/2 … |
Vulnerable Vulnerable |
|
GHSA-prj3-ccx8-p6x4
Aliases: CVE-2025-55163 |
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-5x3r-wrvg-rp6q
Aliases: CVE-2026-47244 |
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced ### Impact DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-563q-j3cm-6jxm
Aliases: CVE-2026-50560 |
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature ### Summary Netty HTTP/2 max header size handling produces attack … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-c2gf-v879-257j
Aliases: CVE-2026-48043 |
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion ### Impact The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-f6hv-jmp6-3vwv
Aliases: CVE-2026-42587 |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS ## Summary `HttpContentDecompressor` accepts a `maxAllocation` … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-c69g-56f8-xwqj
Aliases: CVE-2026-59900 |
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-93wv-jw9v-4972
Aliases: CVE-2026-56819 |
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-w9fj-cfpg-grvv
Aliases: CVE-2026-33871 |
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass ### Summary A remote user can trigger a Denial of … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2026-48043
Aliases: GHSA-c2gf-v879-257j |
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream … | There are no reported fixed by versions. |
|
CVE-2026-93569
Aliases: GHSA-cg2g-fxr4-mg8m |
Inconsistent Interpretation of HTTP Requests A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in … | There are no reported fixed by versions. |
|
CVE-2026-93567
Aliases: GHSA-45h4-vhwh-fmhg |
Improper Input Validation A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component … | There are no reported fixed by versions. |