Search for packages
| purl | pkg:maven/io.netty/netty-codec-http@4.0.14.Final |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-84h7-rjj3-6jx4
Aliases: CVE-2025-67735 |
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder ### Summary The `io.netty.handler.codec.http.HttpRequestEncoder` CRLF injection with the request uri when constructing … |
Vulnerable |
|
GHSA-fghv-69vj-qj49
Aliases: CVE-2025-58056 |
Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions ## Summary A flaw in netty's parsing of … |
Vulnerable |
|
GHSA-269q-hmxg-m83q
Aliases: CVE-2022-24823 |
Local Information Disclosure Vulnerability in io.netty:netty-codec-http ### Description ### [GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) (CVE-2021-21290) contains an insufficient fix for the vulnerability identified. ### … |
Vulnerable |
|
GHSA-5jpm-x58v-624v
Aliases: CVE-2024-29025 |
Netty's HttpPostRequestDecoder can OOM ### Summary The `HttpPostRequestDecoder` can be tricked to accumulate data. I have spotted currently two attack … |
Vulnerable |
|
GHSA-pwqr-wmgm-9rr8
Aliases: CVE-2026-33870 |
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing ## Summary Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer … |
Vulnerable |
|
CVE-2021-21409
Aliases: GHSA-f256-j965-7f32 GHSA-wm47-8v5p-wjpj |
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development … |
Vulnerable |
|
CVE-2019-16869
|
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty mishandles whitespace before the colon in HTTP headers (such as a … |
Vulnerable |
|
CVE-2019-20445
|
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) `HttpObjectDecoder.java` in Netty allows a Content-Length header to be accompanied by a … |
Vulnerable |
|
GHSA-gcjf-9mgh-3p7g
Aliases: CVE-2026-59921 |
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder # Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty … |
Vulnerable |
|
GHSA-6cqp-g7gg-8hr5
Aliases: CVE-2026-56746 |
Netty: Security Control Bypass via CORS Short-Circuit Failure ### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized … |
Vulnerable |
|
CVE-2026-41417
Aliases: GHSA-v8h7-rr48-vmmv |
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection Netty allows request-line validation to be bypassed … | There are no reported fixed by versions. |
|
CVE-2026-50020
Aliases: GHSA-hvcg-qmg6-jm4c |
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted Before reading the first request-line, `HttpObjectDecoder` … | There are no reported fixed by versions. |
|
CVE-2026-42585
Aliases: GHSA-38f8-5428-x5cv |
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. | There are no reported fixed by versions. |
|
CVE-2026-42581
Aliases: GHSA-xxqh-mfjm-7mv9 |
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization `HttpObjectDecoder` strips a conflicting `Content-Length` header when a request carries both `Transfer-Encoding: chunked` … | There are no reported fixed by versions. |
|
CVE-2021-43797
Aliases: GHSA-wx5j-54mm-rqqq |
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Netty is an asynchronous event-driven network application framework for rapid development of … | There are no reported fixed by versions. |
|
CVE-2026-42580
Aliases: GHSA-m4cv-j2px-7723 |
Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing Netty's chunk size parser silently overflows int, enabling … | There are no reported fixed by versions. |
|
CVE-2026-42587
Aliases: GHSA-f6hv-jmp6-3vwv |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to … | There are no reported fixed by versions. |
|
CVE-2026-42584
Aliases: GHSA-57rv-r2g8-2cj3 |
Netty has HttpClientCodec response desynchronization If HttpClientCodec is configured, there are use cases when a response body from one request, … | There are no reported fixed by versions. |
|
CVE-2019-20444
Aliases: GHSA-cqqj-4p63-rrmm |
HTTP Request Smuggling in Netty HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might … | There are no reported fixed by versions. |
|
CVE-2021-21290
Aliases: GHSA-5mcr-gq6c-3hq2 |
Creation of Temporary File With Insecure Permissions Netty is an open-source, asynchronous event-driven network application framework for rapid development of … |
Vulnerable Vulnerable |
|
CVE-2026-59921
Aliases: GHSA-gcjf-9mgh-3p7g |
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder | Field | Value | |-------|-------| | **Product** | Netty | … | There are no reported fixed by versions. |
|
CVE-2026-59898
Aliases: GHSA-4mp9-239f-g9hg |
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker … | There are no reported fixed by versions. |
|
CVE-2026-56746
Aliases: GHSA-6cqp-g7gg-8hr5 |
Netty: Security Control Bypass via CORS Short-Circuit Failure Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests … | There are no reported fixed by versions. |
|
CVE-2026-59899
Aliases: GHSA-q4f6-jm68-57ww |
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service `HttpContentEncoder` (the superclass of the production … | There are no reported fixed by versions. |
|
GHSA-wx5j-54mm-rqqq
Aliases: CVE-2021-43797 |
HTTP request smuggling in netty ### Impact Netty currently just skips control chars when these are present at the beginning … |
Vulnerable Vulnerable |
|
GHSA-5mcr-gq6c-3hq2
Aliases: CVE-2021-21290 |
Local Information Disclosure Vulnerability in Netty on Unix-Like systems ### Impact When netty's multipart decoders are used local information disclosure … |
Vulnerable Vulnerable |
|
GHSA-hvcg-qmg6-jm4c
Aliases: CVE-2026-50020 |
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted ## Summary Before reading the first … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-xxqh-mfjm-7mv9
Aliases: CVE-2026-42581 |
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization # NETTY HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization | Field | Value | … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-57rv-r2g8-2cj3
Aliases: CVE-2026-42584 |
Netty has HttpClientCodec response desynchronization ### Summary If HttpClientCodec is configured, there are use cases when a response body from … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-f6hv-jmp6-3vwv
Aliases: CVE-2026-42587 |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS ## Summary `HttpContentDecompressor` accepts a `maxAllocation` … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-v8h7-rr48-vmmv
Aliases: CVE-2026-41417 |
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection ### Summary Netty allows request-line validation to … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-m4cv-j2px-7723
Aliases: CVE-2026-42580 |
Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing ### Summary Netty's chunk size parser silently overflows … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-38f8-5428-x5cv
Aliases: CVE-2026-42585 |
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding ### Summary Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-q4f6-jm68-57ww
Aliases: CVE-2026-59899 |
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service ### Impact `HttpContentEncoder` (the superclass of … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-4mp9-239f-g9hg
Aliases: CVE-2026-59898 |
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation ## Summary An attacker can force WebSocket upgrade via the lax V07 (or … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-8c42-7qj2-3j46
Aliases: CVE-2026-59903 |
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite ### Summary Netty's `CorsHandler` silently overwrites existing … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-cqqj-4p63-rrmm
Aliases: CVE-2019-20444 |
HTTP Request Smuggling in Netty HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might … | There are no reported fixed by versions. |
|
CVE-2026-59903
Aliases: GHSA-8c42-7qj2-3j46 |
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite Netty's `CorsHandler` silently overwrites existing `Vary` headers, … | There are no reported fixed by versions. |
|
CVE-2026-93565
Aliases: GHSA-h75q-xqrh-59rf |
Incorrect Behavior Order: Validate Before Canonicalize A flaw was found in Netty `RtspDecoder`. The `RtspMethods.valueOf()` function incorrectly strips trailing control … | There are no reported fixed by versions. |
|
CVE-2026-100666
Aliases: GHSA-2g6j-r8q9-5hr8 |
Inconsistent Interpretation of HTTP Requests Netty's `HttpServerCodec` pairs each outbound response with an inbound request by calling `pollMethod()` once per … | There are no reported fixed by versions. |