Search for packages
| purl | pkg:maven/io.netty/netty-codec@4.1.80.Final |
| Next non-vulnerable version | 4.1.136.Final |
| Latest non-vulnerable version | 4.1.136.Final |
| Risk score | 3.9 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-3p8m-j85q-pgmj
Aliases: CVE-2025-58057 |
Netty's decoders vulnerable to DoS via zip bomb style attack ### Summary With specially crafted input, `BrotliDecoder` and some other … |
Vulnerable |
|
GHSA-mj4r-2hfc-f8p6
Aliases: CVE-2026-42583 |
Netty Lz4FrameDecoder is vulnerable to resource exhaustion ### Summary Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB … |
Vulnerable |
|
GHSA-558v-64gr-wgg4
Aliases: CVE-2026-59901 |
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang The `Bzip2Decoder` handler in Netty's compression codec … |
Not vulnerable |
|
CVE-2026-42583
Aliases: GHSA-mj4r-2hfc-f8p6 |
Netty Lz4FrameDecoder is vulnerable to resource exhaustion Lz4FrameDecoder allocates a ByteBuf of size `decompressedLength` (up to 32 MB per block) … | There are no reported fixed by versions. |
|
CVE-2026-59901
Aliases: GHSA-558v-64gr-wgg4 |
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang The `Bzip2Decoder` handler in Netty's compression codec … | There are no reported fixed by versions. |