Search for packages
| purl | pkg:maven/io.netty/netty-handler@4.1.9.Final |
| Next non-vulnerable version | 4.1.137.Final |
| Latest non-vulnerable version | 4.2.17.Final |
| Risk score | 4.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2021-21290
|
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. … |
Vulnerable |
|
GHSA-57m8-f3v5-hm5m
Aliases: CVE-2023-4586 |
Withdrawn Advisory: Netty-handler does not validate host names by default ## Withdrawn Advisory This advisory has been withdrawn because the … | There are no reported fixed by versions. |
|
GHSA-6mjq-h674-j845
Aliases: CVE-2023-34462 |
netty-handler SniHandler 16MB allocation ### Summary The `SniHandler` can allocate up to 16MB of heap for each channel during the … |
Vulnerable |
|
GHSA-c653-97m9-rcg9
Aliases: CVE-2026-50010 |
Netty: Wrapping plain trust manager silently disables hostname verification SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, … |
Vulnerable |
|
GHSA-mm9x-g8pc-w292
Aliases: CVE-2020-11612 |
Denial of Service in Netty The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a … | There are no reported fixed by versions. |
|
CVE-2021-21409
Aliases: GHSA-f256-j965-7f32 GHSA-wm47-8v5p-wjpj |
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling) Netty is an open-source, asynchronous event-driven network application framework for rapid development … |
Vulnerable |
|
CVE-2019-20444
Aliases: GHSA-cqqj-4p63-rrmm |
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a … | There are no reported fixed by versions. |
|
CVE-2019-20445
Aliases: GHSA-p2v9-g2qv-p635 |
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied … | There are no reported fixed by versions. |
|
CVE-2026-45416
Aliases: GHSA-x4gw-5cx5-pgmh |
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, … | There are no reported fixed by versions. |
|
CVE-2026-44249
Aliases: GHSA-3qp7-7mw8-wx86 |
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking An attacker can bypass IPv6 subnet rules due to … | There are no reported fixed by versions. |
|
CVE-2026-50010
Aliases: GHSA-c653-97m9-rcg9 |
Netty: Wrapping plain trust manager silently disables hostname verification SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, … | There are no reported fixed by versions. |
|
CVE-2021-21290
Aliases: GHSA-5mcr-gq6c-3hq2 |
Creation of Temporary File With Insecure Permissions Netty is an open-source, asynchronous event-driven network application framework for rapid development of … |
Vulnerable Vulnerable |
|
GHSA-x4gw-5cx5-pgmh
Aliases: CVE-2026-45416 |
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-3qp7-7mw8-wx86
Aliases: CVE-2026-44249 |
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking ### Summary An attacker can bypass IPv6 subnet rules … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-fccg-mwvh-qqg4
Aliases: CVE-2026-75596 |
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing ### Summary Netty's default SNI entrypoint reparses and … |
Not vulnerable Not vulnerable Not vulnerable |
|
GHSA-c4c3-7fpv-j4q5
Aliases: CVE-2026-75595 |
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext ### Summary A fragmented TLS ClientHello whose … |
Not vulnerable Not vulnerable Not vulnerable |
|
GHSA-p2v9-g2qv-p635
Aliases: CVE-2019-20445 |
HTTP Request Smuggling in Netty HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second … | There are no reported fixed by versions. |
|
CVE-2026-75596
Aliases: GHSA-fccg-mwvh-qqg4 |
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing Netty's default SNI entrypoint reparses and recopies previously … | There are no reported fixed by versions. |
|
CVE-2026-75595
Aliases: GHSA-c4c3-7fpv-j4q5 |
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext A fragmented TLS ClientHello whose handshake header … | There are no reported fixed by versions. |
|
CVE-2026-62243
Aliases: GHSA-p85m-gvr3-788c |
Improper Validation of Certificate with Host Mismatch Netty disables TLS hostname verification on the `SslProvider.OPENSSL` client path when a plain … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2016-4970
|
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite … |