Search for packages
| purl | pkg:maven/io.netty/netty-codec-http@4.2.16 |
| Tags | Ghost |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2026-59921
|
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder | Field | Value | |-------|-------| | **Product** | Netty | … |
GHSA-gcjf-9mgh-3p7g
|
|
CVE-2026-56745
|
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates … |
GHSA-jppx-w49h-x2qq
|
|
CVE-2026-59898
|
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation An attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker … |
GHSA-4mp9-239f-g9hg
|
|
CVE-2026-55831
|
Netty SPDY SETTINGS frame count materializes unbounded settings map Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up … |
GHSA-6jqx-86gh-f27w
|
|
CVE-2026-55833
|
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation Netty SPDY header decoding continues inflating zlib-compressed header blocks … |
GHSA-mvh2-crg5-v77c
|
|
CVE-2026-56746
|
Netty: Security Control Bypass via CORS Short-Circuit Failure Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests … |
GHSA-6cqp-g7gg-8hr5
|
|
CVE-2026-59899
|
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service `HttpContentEncoder` (the superclass of the production … |
GHSA-q4f6-jm68-57ww
|