Search for packages
| purl | pkg:maven/io.netty/netty-codec-http@4.2.0.RC4 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.4 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-84h7-rjj3-6jx4
Aliases: CVE-2025-67735 |
Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder ### Summary The `io.netty.handler.codec.http.HttpRequestEncoder` CRLF injection with the request uri when constructing … |
Vulnerable |
|
GHSA-fghv-69vj-qj49
Aliases: CVE-2025-58056 |
Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions ## Summary A flaw in netty's parsing of … |
Vulnerable |
|
GHSA-pwqr-wmgm-9rr8
Aliases: CVE-2026-33870 |
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing ## Summary Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer … |
Vulnerable |
|
CVE-2026-41417
Aliases: GHSA-v8h7-rr48-vmmv |
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection Netty allows request-line validation to be bypassed … | There are no reported fixed by versions. |
|
CVE-2026-42585
Aliases: GHSA-38f8-5428-x5cv |
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. | There are no reported fixed by versions. |
|
CVE-2026-42581
Aliases: GHSA-xxqh-mfjm-7mv9 |
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization `HttpObjectDecoder` strips a conflicting `Content-Length` header when a request carries both `Transfer-Encoding: chunked` … | There are no reported fixed by versions. |
|
CVE-2026-42580
Aliases: GHSA-m4cv-j2px-7723 |
Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing Netty's chunk size parser silently overflows int, enabling … | There are no reported fixed by versions. |
|
CVE-2026-42587
Aliases: GHSA-f6hv-jmp6-3vwv |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS `HttpContentDecompressor` accepts a `maxAllocation` parameter to … | There are no reported fixed by versions. |
|
CVE-2026-42584
Aliases: GHSA-57rv-r2g8-2cj3 |
Netty has HttpClientCodec response desynchronization If HttpClientCodec is configured, there are use cases when a response body from one request, … | There are no reported fixed by versions. |
|
GHSA-xxqh-mfjm-7mv9
Aliases: CVE-2026-42581 |
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization # NETTY HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization | Field | Value | … |
Vulnerable Vulnerable |
|
GHSA-57rv-r2g8-2cj3
Aliases: CVE-2026-42584 |
Netty has HttpClientCodec response desynchronization ### Summary If HttpClientCodec is configured, there are use cases when a response body from … |
Vulnerable Vulnerable |
|
GHSA-f6hv-jmp6-3vwv
Aliases: CVE-2026-42587 |
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS ## Summary `HttpContentDecompressor` accepts a `maxAllocation` … |
Vulnerable Vulnerable |
|
GHSA-v8h7-rr48-vmmv
Aliases: CVE-2026-41417 |
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection ### Summary Netty allows request-line validation to … |
Vulnerable Vulnerable |
|
GHSA-m4cv-j2px-7723
Aliases: CVE-2026-42580 |
Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing ### Summary Netty's chunk size parser silently overflows … |
Vulnerable Vulnerable |
|
GHSA-38f8-5428-x5cv
Aliases: CVE-2026-42585 |
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding ### Summary Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling … |
Vulnerable Vulnerable |