VulnerableCode Package Details - pkg:maven/io.netty/netty-codec-http@4.2.14.Final

Vulnerabilities affecting this package (21)

Advisory	Summary	Fixed in package version
GHSA-gcjf-9mgh-3p7g Aliases: CVE-2026-59921	Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder # Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty …	4.2.16.Final Vulnerable
GHSA-6cqp-g7gg-8hr5 Aliases: CVE-2026-56746	Netty: Security Control Bypass via CORS Short-Circuit Failure ### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized …	4.2.16.Final Vulnerable
CVE-2026-50020 Aliases: GHSA-hvcg-qmg6-jm4c	Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted Before reading the first request-line, `HttpObjectDecoder` …	There are no reported fixed by versions.
CVE-2026-59921 Aliases: GHSA-gcjf-9mgh-3p7g	Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder \| Field \| Value \| \|-------\|-------\| \| Product \| Netty \| …	There are no reported fixed by versions.
CVE-2026-56745 Aliases: GHSA-jppx-w49h-x2qq	Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates …	There are no reported fixed by versions.
CVE-2026-59898 Aliases: GHSA-4mp9-239f-g9hg	Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker …	There are no reported fixed by versions.
CVE-2026-55831 Aliases: GHSA-6jqx-86gh-f27w	Netty SPDY SETTINGS frame count materializes unbounded settings map Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up …	There are no reported fixed by versions.
CVE-2026-55833 Aliases: GHSA-mvh2-crg5-v77c	Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation Netty SPDY header decoding continues inflating zlib-compressed header blocks …	There are no reported fixed by versions.
CVE-2026-56746 Aliases: GHSA-6cqp-g7gg-8hr5	Netty: Security Control Bypass via CORS Short-Circuit Failure Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests …	There are no reported fixed by versions.
CVE-2026-59899 Aliases: GHSA-q4f6-jm68-57ww	Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service `HttpContentEncoder` (the superclass of the production …	There are no reported fixed by versions.
GHSA-hvcg-qmg6-jm4c Aliases: CVE-2026-50020	Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted ## Summary Before reading the first …	4.2.15.Final Vulnerable 4.2.15.Final Vulnerable
GHSA-mvh2-crg5-v77c Aliases: CVE-2026-55833	Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation ### Summary Netty SPDY header decoding continues inflating zlib-compressed …	4.2.16.Final Vulnerable 4.2.16.Final Vulnerable
GHSA-6jqx-86gh-f27w Aliases: CVE-2026-55831	Netty SPDY SETTINGS frame count materializes unbounded settings map ### Summary Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry …	4.2.16.Final Vulnerable 4.2.16.Final Vulnerable
GHSA-q4f6-jm68-57ww Aliases: CVE-2026-59899	Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service ### Impact `HttpContentEncoder` (the superclass of …	4.2.16.Final Vulnerable 4.2.16.Final Vulnerable
GHSA-4mp9-239f-g9hg Aliases: CVE-2026-59898	Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation ## Summary An attacker can force WebSocket upgrade via the lax V07 (or …	4.2.16.Final Vulnerable 4.2.16.Final Vulnerable
GHSA-jppx-w49h-x2qq Aliases: CVE-2026-56745	Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates …	4.2.16.Final Vulnerable 4.2.16.Final Vulnerable
GHSA-8c42-7qj2-3j46 Aliases: CVE-2026-59903	Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite ### Summary Netty's `CorsHandler` silently overwrites existing …	4.2.17.Final Vulnerable 4.2.17.Final Vulnerable
CVE-2026-59903 Aliases: GHSA-8c42-7qj2-3j46	Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite Netty's `CorsHandler` silently overwrites existing `Vary` headers, …	There are no reported fixed by versions.
CVE-2026-93565 Aliases: GHSA-h75q-xqrh-59rf	Incorrect Behavior Order: Validate Before Canonicalize A flaw was found in Netty `RtspDecoder`. The `RtspMethods.valueOf()` function incorrectly strips trailing control …	There are no reported fixed by versions.
CVE-2026-93558 Aliases: GHSA-2g37-3h88-55hc	Uncontrolled Resource Consumption A flaw was found in Netty's `WebSocketServerExtensionHandler`. A remote, unauthenticated attacker can exploit this vulnerability by using …	There are no reported fixed by versions.
CVE-2026-100666 Aliases: GHSA-2g6j-r8q9-5hr8	Inconsistent Interpretation of HTTP Requests Netty's `HttpServerCodec` pairs each outbound response with an inbound request by calling `pollMethod()` once per …	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	3.9