Search for packages
| purl | pkg:maven/io.netty/netty-codec@4.0.43.Final |
| Next non-vulnerable version | 4.1.136.Final |
| Latest non-vulnerable version | 4.1.136.Final |
| Risk score | 3.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-3p8m-j85q-pgmj
Aliases: CVE-2025-58057 |
Netty's decoders vulnerable to DoS via zip bomb style attack ### Summary With specially crafted input, `BrotliDecoder` and some other … |
Vulnerable |
|
GHSA-mj4r-2hfc-f8p6
Aliases: CVE-2026-42583 |
Netty Lz4FrameDecoder is vulnerable to resource exhaustion ### Summary Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB … |
Vulnerable |
|
CVE-2021-21409
Aliases: GHSA-f256-j965-7f32 GHSA-wm47-8v5p-wjpj |
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development … |
Vulnerable |
|
CVE-2021-37137
Aliases: GHSA-9vjp-v76f-g363 |
Uncontrolled Resource Consumption The Snappy frame decoder function does not restrict the chunk length which may lead to excessive memory … | There are no reported fixed by versions. |
|
CVE-2021-37136
Aliases: GHSA-grg4-wf29-r9vv |
Uncontrolled Resource Consumption The Bzip2 decompression decoder function does not allow setting size restrictions on the decompressed output data (which … | There are no reported fixed by versions. |
|
GHSA-558v-64gr-wgg4
Aliases: CVE-2026-59901 |
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang The `Bzip2Decoder` handler in Netty's compression codec … |
Not vulnerable |
|
CVE-2026-42583
Aliases: GHSA-mj4r-2hfc-f8p6 |
Netty Lz4FrameDecoder is vulnerable to resource exhaustion Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB per block) … | There are no reported fixed by versions. |
|
CVE-2026-59901
Aliases: GHSA-558v-64gr-wgg4 |
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang The `Bzip2Decoder` handler in Netty's compression codec … | There are no reported fixed by versions. |
|
GHSA-9vjp-v76f-g363
Aliases: CVE-2021-37137 |
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way ### Impact The Snappy frame decoder … |
Vulnerable Vulnerable |
|
GHSA-grg4-wf29-r9vv
Aliases: CVE-2021-37136 |
Bzip2Decoder doesn't allow setting size restrictions for decompressed data ### Impact The Bzip2 decompression decoder function doesn't allow setting size … |
Vulnerable Vulnerable |