Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/io.netty/netty-codec-http2@4.2.0-Alpha.1
purl pkg:maven/io.netty/netty-codec-http2@4.2.0-Alpha.1
Tags Ghost
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score
Vulnerabilities affecting this package (2)
Advisory Summary Fixed in package version
CVE-2026-42587
Aliases:
GHSA-f6hv-jmp6-3vwv
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to … There are no reported fixed by versions.
CVE-2026-48043
Aliases:
GHSA-c2gf-v879-257j
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream … There are no reported fixed by versions.
This package is not known to fix any advisories.