Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/io.netty/netty-codec-http@4.1.133
purl pkg:maven/io.netty/netty-codec-http@4.1.133
Tags Ghost
This package is not known to be subject of any advisories.
Vulnerabilities fixed by this package (6)

Advisory Summary Aliases
CVE-2026-41417
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection Netty allows request-line validation to be bypassed … GHSA-v8h7-rr48-vmmv
CVE-2026-42585
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. GHSA-38f8-5428-x5cv
CVE-2026-42581
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization `HttpObjectDecoder` strips a conflicting `Content-Length` header when a request carries both `Transfer-Encoding: chunked` … GHSA-xxqh-mfjm-7mv9
CVE-2026-42580
Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing Netty's chunk size parser silently overflows int, enabling … GHSA-m4cv-j2px-7723
CVE-2026-42587
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to … GHSA-f6hv-jmp6-3vwv
CVE-2026-42584
Netty has HttpClientCodec response desynchronization If HttpClientCodec is configured, there are use cases when a response body from one request, … GHSA-57rv-r2g8-2cj3