Search for packages
| purl | pkg:maven/io.netty/netty-codec-http2@4.2.0.RC4 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2026-42587
Aliases: GHSA-f6hv-jmp6-3vwv |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to … | There are no reported fixed by versions. |
|
GHSA-prj3-ccx8-p6x4
Aliases: CVE-2025-55163 |
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which … |
Vulnerable Vulnerable |
|
GHSA-c2gf-v879-257j
Aliases: CVE-2026-48043 |
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion ### Impact The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-f6hv-jmp6-3vwv
Aliases: CVE-2026-42587 |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS ## Summary `HttpContentDecompressor` accepts a `maxAllocation` … |
Vulnerable Vulnerable |
|
GHSA-w9fj-cfpg-grvv
Aliases: CVE-2026-33871 |
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass ### Summary A remote user can trigger a Denial of … |
Vulnerable Vulnerable |
|
CVE-2026-48043
Aliases: GHSA-c2gf-v879-257j |
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion The `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream … | There are no reported fixed by versions. |