VulnerableCode Package Details - pkg:maven/io.netty/netty-codec-http@4.0.23.Final

Vulnerabilities affecting this package (44)

Advisory	Summary	Fixed in package version
CVE-2015-2156	Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might …	4.0.28.Final Vulnerable 4.0.29.Final Vulnerable 4.0.31.Final Vulnerable 4.0.32.Final Vulnerable 4.0.33.Final Vulnerable 4.0.34.Final Vulnerable 4.0.36.Final Vulnerable 4.0.40.Final Vulnerable 4.0.56.Final Vulnerable 4.1.0.Beta7 Vulnerable 4.1.0.CR7 Vulnerable 4.1.3.Final Vulnerable 4.1.5.Final Vulnerable 4.1.6.Final Vulnerable 4.1.7.Final Vulnerable 4.1.8.Final Vulnerable 4.1.9.Final Vulnerable 4.1.11.Final Vulnerable 4.1.12.Final Vulnerable 4.1.13.Final Vulnerable 4.1.15.Final Vulnerable 4.1.16.Final Vulnerable 4.1.17.Final Vulnerable 4.1.18.Final Vulnerable 4.1.19.Final Vulnerable 4.1.20.Final Vulnerable 4.1.21.Final Vulnerable 4.1.22.Final Vulnerable 4.1.23.Final Vulnerable 4.1.24.Final Vulnerable 4.1.25.Final Vulnerable 4.1.27.Final Vulnerable 4.1.28.Final Vulnerable 4.1.29.Final Vulnerable 4.1.30.Final Vulnerable 4.1.31.Final Vulnerable 4.1.32.Final Vulnerable 4.1.33.Final Vulnerable 4.1.34.Final Vulnerable 4.1.35.Final Vulnerable 4.1.36.Final Vulnerable 4.1.38.Final Vulnerable 4.1.39.Final Vulnerable 4.1.40.Final Vulnerable 4.1.41.Final Vulnerable 4.1.42.Final Vulnerable 4.1.43.Final Vulnerable 4.1.44.Final Vulnerable 4.1.45.Final Vulnerable 4.1.46.Final Vulnerable 4.1.47.Final Vulnerable 4.1.48.Final Vulnerable 4.1.49.Final Vulnerable 4.1.50.Final Vulnerable 4.1.51.Final Vulnerable
CVE-2020-7238	Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length …	4.1.44.Final Vulnerable 4.1.45.Final Vulnerable
CVE-2019-20445	HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a …	4.1.44.Final Vulnerable 4.1.45.Final Vulnerable
CVE-2019-16869	Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads …	4.1.42.Final Vulnerable 4.1.43.Final Vulnerable 4.1.45.Final Vulnerable
GHSA-84h7-rjj3-6jx4 Aliases: CVE-2025-67735	Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder ### Summary The `io.netty.handler.codec.http.HttpRequestEncoder` CRLF injection with the request uri when constructing …	4.1.129.Final Vulnerable
GHSA-fghv-69vj-qj49 Aliases: CVE-2025-58056	Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions ## Summary A flaw in netty's parsing of …	4.1.125.Final Vulnerable
GHSA-269q-hmxg-m83q Aliases: CVE-2022-24823	Local Information Disclosure Vulnerability in io.netty:netty-codec-http ### Description ### [GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) (CVE-2021-21290) contains an insufficient fix for the vulnerability identified. ### …	4.1.77.Final Vulnerable
GHSA-5jpm-x58v-624v Aliases: CVE-2024-29025	Netty's HttpPostRequestDecoder can OOM ### Summary The `HttpPostRequestDecoder` can be tricked to accumulate data. I have spotted currently two attack …	4.1.108.Final Vulnerable
GHSA-pwqr-wmgm-9rr8 Aliases: CVE-2026-33870	Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing ## Summary Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer …	4.1.132.Final Vulnerable
CVE-2021-21409 Aliases: GHSA-f256-j965-7f32 GHSA-wm47-8v5p-wjpj	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development …	4.1.61.Final Vulnerable
CVE-2019-16869	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty mishandles whitespace before the colon in HTTP headers (such as a …	4.1.42.Final Vulnerable
CVE-2019-20445	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) `HttpObjectDecoder.java` in Netty allows a Content-Length header to be accompanied by a …	4.1.44.Final Vulnerable
GHSA-gcjf-9mgh-3p7g Aliases: CVE-2026-59921	Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder # Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty …	4.1.136.Final Vulnerable
GHSA-6cqp-g7gg-8hr5 Aliases: CVE-2026-56746	Netty: Security Control Bypass via CORS Short-Circuit Failure ### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized …	4.1.136.Final Vulnerable
CVE-2026-41417 Aliases: GHSA-v8h7-rr48-vmmv	Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection Netty allows request-line validation to be bypassed …	There are no reported fixed by versions.
CVE-2026-50020 Aliases: GHSA-hvcg-qmg6-jm4c	Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted Before reading the first request-line, `HttpObjectDecoder` …	There are no reported fixed by versions.
CVE-2026-42585 Aliases: GHSA-38f8-5428-x5cv	Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks.	There are no reported fixed by versions.
CVE-2026-42581 Aliases: GHSA-xxqh-mfjm-7mv9	Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization `HttpObjectDecoder` strips a conflicting `Content-Length` header when a request carries both `Transfer-Encoding: chunked` …	There are no reported fixed by versions.
CVE-2021-43797 Aliases: GHSA-wx5j-54mm-rqqq	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Netty is an asynchronous event-driven network application framework for rapid development of …	There are no reported fixed by versions.
CVE-2026-42580 Aliases: GHSA-m4cv-j2px-7723	Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing Netty's chunk size parser silently overflows int, enabling …	There are no reported fixed by versions.
CVE-2026-42587 Aliases: GHSA-f6hv-jmp6-3vwv	Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to …	There are no reported fixed by versions.
CVE-2026-42584 Aliases: GHSA-57rv-r2g8-2cj3	Netty has HttpClientCodec response desynchronization If HttpClientCodec is configured, there are use cases when a response body from one request, …	There are no reported fixed by versions.
CVE-2019-20444 Aliases: GHSA-cqqj-4p63-rrmm	HTTP Request Smuggling in Netty HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might …	There are no reported fixed by versions.
CVE-2021-21290 Aliases: GHSA-5mcr-gq6c-3hq2	Creation of Temporary File With Insecure Permissions Netty is an open-source, asynchronous event-driven network application framework for rapid development of …	4.1.59.Final Vulnerable 4.1.59.Final Vulnerable
CVE-2026-59921 Aliases: GHSA-gcjf-9mgh-3p7g	Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder \| Field \| Value \| \|-------\|-------\| \| Product \| Netty \| …	There are no reported fixed by versions.
CVE-2026-59898 Aliases: GHSA-4mp9-239f-g9hg	Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker …	There are no reported fixed by versions.
CVE-2026-56746 Aliases: GHSA-6cqp-g7gg-8hr5	Netty: Security Control Bypass via CORS Short-Circuit Failure Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests …	There are no reported fixed by versions.
CVE-2026-59899 Aliases: GHSA-q4f6-jm68-57ww	Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service `HttpContentEncoder` (the superclass of the production …	There are no reported fixed by versions.
GHSA-wx5j-54mm-rqqq Aliases: CVE-2021-43797	HTTP request smuggling in netty ### Impact Netty currently just skips control chars when these are present at the beginning …	4.1.71.Final Vulnerable 4.1.71.Final Vulnerable
GHSA-5mcr-gq6c-3hq2 Aliases: CVE-2021-21290	Local Information Disclosure Vulnerability in Netty on Unix-Like systems ### Impact When netty's multipart decoders are used local information disclosure …	4.1.59.Final Vulnerable 4.1.59.Final Vulnerable
GHSA-hvcg-qmg6-jm4c Aliases: CVE-2026-50020	Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted ## Summary Before reading the first …	4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-xxqh-mfjm-7mv9 Aliases: CVE-2026-42581	Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization # NETTY HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization \| Field \| Value \| …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-57rv-r2g8-2cj3 Aliases: CVE-2026-42584	Netty has HttpClientCodec response desynchronization ### Summary If HttpClientCodec is configured, there are use cases when a response body from …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-f6hv-jmp6-3vwv Aliases: CVE-2026-42587	Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS ## Summary `HttpContentDecompressor` accepts a `maxAllocation` …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-v8h7-rr48-vmmv Aliases: CVE-2026-41417	Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection ### Summary Netty allows request-line validation to …	4.1.133.Final Vulnerable 4.2.13.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-m4cv-j2px-7723 Aliases: CVE-2026-42580	Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing ### Summary Netty's chunk size parser silently overflows …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-38f8-5428-x5cv Aliases: CVE-2026-42585	Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding ### Summary Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-q4f6-jm68-57ww Aliases: CVE-2026-59899	Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service ### Impact `HttpContentEncoder` (the superclass of …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-4mp9-239f-g9hg Aliases: CVE-2026-59898	Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation ## Summary An attacker can force WebSocket upgrade via the lax V07 (or …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-8c42-7qj2-3j46 Aliases: CVE-2026-59903	Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite ### Summary Netty's `CorsHandler` silently overwrites existing …	4.2.17.Final Vulnerable 4.1.137.Final Vulnerable 4.1.137.Final Vulnerable
GHSA-cqqj-4p63-rrmm Aliases: CVE-2019-20444	HTTP Request Smuggling in Netty HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might …	There are no reported fixed by versions.
CVE-2026-59903 Aliases: GHSA-8c42-7qj2-3j46	Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite Netty's `CorsHandler` silently overwrites existing `Vary` headers, …	There are no reported fixed by versions.
CVE-2026-93565 Aliases: GHSA-h75q-xqrh-59rf	Incorrect Behavior Order: Validate Before Canonicalize A flaw was found in Netty `RtspDecoder`. The `RtspMethods.valueOf()` function incorrectly strips trailing control …	There are no reported fixed by versions.
CVE-2026-100666 Aliases: GHSA-2g6j-r8q9-5hr8	Inconsistent Interpretation of HTTP Requests Netty's `HttpServerCodec` pairs each outbound response with an inbound request by calling `pollMethod()` once per …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	4.1