Search for packages
| purl | pkg:maven/io.netty/netty-handler@4.2.0 |
| Tags | Ghost |
| Next non-vulnerable version | 4.2.17.Final |
| Latest non-vulnerable version | 4.2.17.Final |
| Risk score |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2026-45416
Aliases: GHSA-x4gw-5cx5-pgmh |
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, … | There are no reported fixed by versions. |
|
CVE-2026-44249
Aliases: GHSA-3qp7-7mw8-wx86 |
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking An attacker can bypass IPv6 subnet rules due to … | There are no reported fixed by versions. |
|
CVE-2026-50010
Aliases: GHSA-c653-97m9-rcg9 |
Netty: Wrapping plain trust manager silently disables hostname verification SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, … | There are no reported fixed by versions. |
|
CVE-2026-75596
Aliases: GHSA-fccg-mwvh-qqg4 |
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing Netty's default SNI entrypoint reparses and recopies previously … | There are no reported fixed by versions. |
|
CVE-2026-75595
Aliases: GHSA-c4c3-7fpv-j4q5 |
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext A fragmented TLS ClientHello whose handshake header … | There are no reported fixed by versions. |
|
CVE-2026-62243
Aliases: GHSA-p85m-gvr3-788c |
Improper Validation of Certificate with Host Mismatch Netty disables TLS hostname verification on the `SslProvider.OPENSSL` client path when a plain … | There are no reported fixed by versions. |