Search for packages
| purl | pkg:maven/io.netty/netty-codec-http@4.2.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2026-50020
Aliases: GHSA-hvcg-qmg6-jm4c |
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted Before reading the first request-line, `HttpObjectDecoder` … | There are no reported fixed by versions. |
|
CVE-2026-59921
Aliases: GHSA-gcjf-9mgh-3p7g |
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder | Field | Value | |-------|-------| | **Product** | Netty | … | There are no reported fixed by versions. |
|
CVE-2026-56745
Aliases: GHSA-jppx-w49h-x2qq |
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates … | There are no reported fixed by versions. |
|
CVE-2026-59898
Aliases: GHSA-4mp9-239f-g9hg |
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker … | There are no reported fixed by versions. |
|
CVE-2026-55831
Aliases: GHSA-6jqx-86gh-f27w |
Netty SPDY SETTINGS frame count materializes unbounded settings map Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up … | There are no reported fixed by versions. |
|
CVE-2026-55833
Aliases: GHSA-mvh2-crg5-v77c |
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation Netty SPDY header decoding continues inflating zlib-compressed header blocks … | There are no reported fixed by versions. |
|
CVE-2026-56746
Aliases: GHSA-6cqp-g7gg-8hr5 |
Netty: Security Control Bypass via CORS Short-Circuit Failure Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests … | There are no reported fixed by versions. |
|
CVE-2026-59899
Aliases: GHSA-q4f6-jm68-57ww |
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service `HttpContentEncoder` (the superclass of the production … | There are no reported fixed by versions. |
|
CVE-2026-59903
Aliases: GHSA-8c42-7qj2-3j46 |
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite Netty's `CorsHandler` silently overwrites existing `Vary` headers, … | There are no reported fixed by versions. |
|
CVE-2026-93565
Aliases: GHSA-h75q-xqrh-59rf |
Incorrect Behavior Order: Validate Before Canonicalize A flaw was found in Netty `RtspDecoder`. The `RtspMethods.valueOf()` function incorrectly strips trailing control … | There are no reported fixed by versions. |
|
CVE-2026-93558
Aliases: GHSA-2g37-3h88-55hc |
Uncontrolled Resource Consumption A flaw was found in Netty's `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit this vulnerability by using … | There are no reported fixed by versions. |
|
CVE-2026-100666
Aliases: GHSA-2g6j-r8q9-5hr8 |
Inconsistent Interpretation of HTTP Requests Netty's `HttpServerCodec` pairs each outbound response with an inbound request by calling `pollMethod()` once per … | There are no reported fixed by versions. |