VulnerableCode Package Details - pkg:maven/io.netty/netty-codec-http@4.1.118.Final

Vulnerabilities affecting this package (36)

Advisory	Summary	Fixed in package version
GHSA-84h7-rjj3-6jx4 Aliases: CVE-2025-67735	Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder ### Summary The `io.netty.handler.codec.http.HttpRequestEncoder` CRLF injection with the request uri when constructing …	4.1.129.Final Vulnerable
GHSA-fghv-69vj-qj49 Aliases: CVE-2025-58056	Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions ## Summary A flaw in netty's parsing of …	4.1.125.Final Vulnerable
GHSA-pwqr-wmgm-9rr8 Aliases: CVE-2026-33870	Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing ## Summary Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer …	4.1.132.Final Vulnerable
GHSA-gcjf-9mgh-3p7g Aliases: CVE-2026-59921	Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder # Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty …	4.1.136.Final Vulnerable
GHSA-6cqp-g7gg-8hr5 Aliases: CVE-2026-56746	Netty: Security Control Bypass via CORS Short-Circuit Failure ### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized …	4.1.136.Final Vulnerable
CVE-2026-41417 Aliases: GHSA-v8h7-rr48-vmmv	Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection Netty allows request-line validation to be bypassed …	There are no reported fixed by versions.
CVE-2026-50020 Aliases: GHSA-hvcg-qmg6-jm4c	Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted Before reading the first request-line, `HttpObjectDecoder` …	There are no reported fixed by versions.
CVE-2026-42585 Aliases: GHSA-38f8-5428-x5cv	Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks.	There are no reported fixed by versions.
CVE-2026-42581 Aliases: GHSA-xxqh-mfjm-7mv9	Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization `HttpObjectDecoder` strips a conflicting `Content-Length` header when a request carries both `Transfer-Encoding: chunked` …	There are no reported fixed by versions.
CVE-2026-42580 Aliases: GHSA-m4cv-j2px-7723	Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing Netty's chunk size parser silently overflows int, enabling …	There are no reported fixed by versions.
CVE-2026-42587 Aliases: GHSA-f6hv-jmp6-3vwv	Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to …	There are no reported fixed by versions.
CVE-2026-42584 Aliases: GHSA-57rv-r2g8-2cj3	Netty has HttpClientCodec response desynchronization If HttpClientCodec is configured, there are use cases when a response body from one request, …	There are no reported fixed by versions.
CVE-2026-59921 Aliases: GHSA-gcjf-9mgh-3p7g	Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder \| Field \| Value \| \|-------\|-------\| \| Product \| Netty \| …	There are no reported fixed by versions.
CVE-2026-56745 Aliases: GHSA-jppx-w49h-x2qq	Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates …	There are no reported fixed by versions.
CVE-2026-59898 Aliases: GHSA-4mp9-239f-g9hg	Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker …	There are no reported fixed by versions.
CVE-2026-55831 Aliases: GHSA-6jqx-86gh-f27w	Netty SPDY SETTINGS frame count materializes unbounded settings map Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up …	There are no reported fixed by versions.
CVE-2026-55833 Aliases: GHSA-mvh2-crg5-v77c	Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation Netty SPDY header decoding continues inflating zlib-compressed header blocks …	There are no reported fixed by versions.
CVE-2026-56746 Aliases: GHSA-6cqp-g7gg-8hr5	Netty: Security Control Bypass via CORS Short-Circuit Failure Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests …	There are no reported fixed by versions.
CVE-2026-59899 Aliases: GHSA-q4f6-jm68-57ww	Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service `HttpContentEncoder` (the superclass of the production …	There are no reported fixed by versions.
GHSA-hvcg-qmg6-jm4c Aliases: CVE-2026-50020	Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted ## Summary Before reading the first …	4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-xxqh-mfjm-7mv9 Aliases: CVE-2026-42581	Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization # NETTY HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization \| Field \| Value \| …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-57rv-r2g8-2cj3 Aliases: CVE-2026-42584	Netty has HttpClientCodec response desynchronization ### Summary If HttpClientCodec is configured, there are use cases when a response body from …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-f6hv-jmp6-3vwv Aliases: CVE-2026-42587	Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS ## Summary `HttpContentDecompressor` accepts a `maxAllocation` …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-v8h7-rr48-vmmv Aliases: CVE-2026-41417	Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection ### Summary Netty allows request-line validation to …	4.1.133.Final Vulnerable 4.2.13.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-m4cv-j2px-7723 Aliases: CVE-2026-42580	Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing ### Summary Netty's chunk size parser silently overflows …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-38f8-5428-x5cv Aliases: CVE-2026-42585	Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding ### Summary Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling …	4.2.13.Final Vulnerable 4.1.133.Final Vulnerable 4.1.133.Final Vulnerable
GHSA-mvh2-crg5-v77c Aliases: CVE-2026-55833	Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation ### Summary Netty SPDY header decoding continues inflating zlib-compressed …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-6jqx-86gh-f27w Aliases: CVE-2026-55831	Netty SPDY SETTINGS frame count materializes unbounded settings map ### Summary Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-q4f6-jm68-57ww Aliases: CVE-2026-59899	Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service ### Impact `HttpContentEncoder` (the superclass of …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-4mp9-239f-g9hg Aliases: CVE-2026-59898	Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation ## Summary An attacker can force WebSocket upgrade via the lax V07 (or …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-jppx-w49h-x2qq Aliases: CVE-2026-56745	Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates …	4.2.16.Final Vulnerable 4.1.136.Final Vulnerable 4.1.136.Final Vulnerable
GHSA-8c42-7qj2-3j46 Aliases: CVE-2026-59903	Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite ### Summary Netty's `CorsHandler` silently overwrites existing …	4.2.17.Final Vulnerable 4.1.137.Final Vulnerable 4.1.137.Final Vulnerable
CVE-2026-59903 Aliases: GHSA-8c42-7qj2-3j46	Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite Netty's `CorsHandler` silently overwrites existing `Vary` headers, …	There are no reported fixed by versions.
CVE-2026-93565 Aliases: GHSA-h75q-xqrh-59rf	Incorrect Behavior Order: Validate Before Canonicalize A flaw was found in Netty `RtspDecoder`. The `RtspMethods.valueOf()` function incorrectly strips trailing control …	There are no reported fixed by versions.
CVE-2026-93558 Aliases: GHSA-2g37-3h88-55hc	Uncontrolled Resource Consumption A flaw was found in Netty's `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit this vulnerability by using …	There are no reported fixed by versions.
CVE-2026-100666 Aliases: GHSA-2g6j-r8q9-5hr8	Inconsistent Interpretation of HTTP Requests Netty's `HttpServerCodec` pairs each outbound response with an inbound request by calling `pollMethod()` once per …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	3.9