VulnerableCode Package Details - pkg:maven/io.netty/netty-handler@4.1.0.Beta7

Vulnerabilities affecting this package (20)

Advisory	Summary	Fixed in package version
CVE-2016-4970	handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite …	4.0.37.Final Vulnerable 4.0.40.Final Vulnerable 4.0.42.Final Vulnerable 4.0.44.Final Vulnerable 4.0.47.Final Vulnerable 4.1.3.Final Vulnerable 4.1.5.Final Vulnerable 4.1.6.Final Vulnerable 4.1.7.Final Vulnerable 4.1.8.Final Vulnerable 4.1.9.Final Vulnerable 4.1.11.Final Vulnerable 4.1.12.Final Vulnerable 4.1.25.Final Vulnerable 4.1.44.Final Vulnerable 4.1.45.Final Vulnerable
GHSA-rv63-gqm8-9w8q Aliases: CVE-2016-4970	Loop with Unreachable Exit Condition in Netty handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers …	4.1.1.Final Vulnerable
GHSA-6mjq-h674-j845 Aliases: CVE-2023-34462	netty-handler SniHandler 16MB allocation ### Summary The `SniHandler` can allocate up to 16MB of heap for each channel during the …	4.1.94.Final Vulnerable
GHSA-c653-97m9-rcg9 Aliases: CVE-2026-50010	Netty: Wrapping plain trust manager silently disables hostname verification SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, …	4.1.135.Final Vulnerable
CVE-2021-21409 Aliases: GHSA-f256-j965-7f32 GHSA-wm47-8v5p-wjpj	Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development …	4.1.61.Final Vulnerable
CVE-2016-4970	Infinite Loop for SSL Handler `handler/ssl/OpenSslEngine.java` in this package allows remote attackers to cause a denial of service (infinite loop).	4.0.37.Final Vulnerable 4.1.1.Final Vulnerable
CVE-2019-20444 Aliases: GHSA-cqqj-4p63-rrmm	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a …	There are no reported fixed by versions.
CVE-2019-20445 Aliases: GHSA-p2v9-g2qv-p635	Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied …	There are no reported fixed by versions.
CVE-2026-45416 Aliases: GHSA-x4gw-5cx5-pgmh	Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, …	There are no reported fixed by versions.
CVE-2026-44249 Aliases: GHSA-3qp7-7mw8-wx86	Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking An attacker can bypass IPv6 subnet rules due to …	There are no reported fixed by versions.
CVE-2026-50010 Aliases: GHSA-c653-97m9-rcg9	Netty: Wrapping plain trust manager silently disables hostname verification SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, …	There are no reported fixed by versions.
CVE-2021-21290 Aliases: GHSA-5mcr-gq6c-3hq2	Creation of Temporary File With Insecure Permissions Netty is an open-source, asynchronous event-driven network application framework for rapid development of …	4.1.59.Final Vulnerable 4.1.59.Final Vulnerable
GHSA-x4gw-5cx5-pgmh Aliases: CVE-2026-45416	Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, …	4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-3qp7-7mw8-wx86 Aliases: CVE-2026-44249	Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking ### Summary An attacker can bypass IPv6 subnet rules …	4.2.15.Final Vulnerable 4.1.135.Final Vulnerable 4.1.135.Final Vulnerable
GHSA-fccg-mwvh-qqg4 Aliases: CVE-2026-75596	Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing ### Summary Netty's default SNI entrypoint reparses and …	4.2.17.Final Not vulnerable 4.1.137.Final Not vulnerable 4.1.137.Final Not vulnerable
GHSA-c4c3-7fpv-j4q5 Aliases: CVE-2026-75595	Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext ### Summary A fragmented TLS ClientHello whose …	4.2.17.Final Not vulnerable 4.1.137.Final Not vulnerable 4.1.137.Final Not vulnerable
GHSA-p2v9-g2qv-p635 Aliases: CVE-2019-20445	HTTP Request Smuggling in Netty HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second …	There are no reported fixed by versions.
CVE-2026-75596 Aliases: GHSA-fccg-mwvh-qqg4	Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing Netty's default SNI entrypoint reparses and recopies previously …	There are no reported fixed by versions.
CVE-2026-75595 Aliases: GHSA-c4c3-7fpv-j4q5	Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext A fragmented TLS ClientHello whose handshake header …	There are no reported fixed by versions.
CVE-2026-62243 Aliases: GHSA-p85m-gvr3-788c	Improper Validation of Certificate with Host Mismatch Netty disables TLS hostname verification on the `SslProvider.OPENSSL` client path when a plain …	There are no reported fixed by versions.

Next non-vulnerable version	4.1.137.Final
Latest non-vulnerable version	4.2.17.Final
Risk score	4.1