Search for packages
| purl | pkg:maven/io.netty/netty-codec-http@4.2.0-Alpha.1 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2026-41417
Aliases: GHSA-v8h7-rr48-vmmv |
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection Netty allows request-line validation to be bypassed … | There are no reported fixed by versions. |
|
CVE-2026-42585
Aliases: GHSA-38f8-5428-x5cv |
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. | There are no reported fixed by versions. |
|
CVE-2026-42581
Aliases: GHSA-xxqh-mfjm-7mv9 |
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization `HttpObjectDecoder` strips a conflicting `Content-Length` header when a request carries both `Transfer-Encoding: chunked` … | There are no reported fixed by versions. |
|
CVE-2026-42580
Aliases: GHSA-m4cv-j2px-7723 |
Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing Netty's chunk size parser silently overflows int, enabling … | There are no reported fixed by versions. |
|
CVE-2026-42587
Aliases: GHSA-f6hv-jmp6-3vwv |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to … | There are no reported fixed by versions. |
|
CVE-2026-42584
Aliases: GHSA-57rv-r2g8-2cj3 |
Netty has HttpClientCodec response desynchronization If HttpClientCodec is configured, there are use cases when a response body from one request, … | There are no reported fixed by versions. |