Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/io.netty/netty-handler@4.2.16.Final
purl pkg:maven/io.netty/netty-handler@4.2.16.Final
Next non-vulnerable version 4.2.17.Final
Latest non-vulnerable version 4.2.17.Final
Risk score 4.1
Vulnerabilities affecting this package (5)
Advisory Summary Fixed in package version
GHSA-fccg-mwvh-qqg4
Aliases:
CVE-2026-75596
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing ### Summary Netty's default SNI entrypoint reparses and …
4.2.17.Final
Not vulnerable
4.2.17.Final
Not vulnerable
GHSA-c4c3-7fpv-j4q5
Aliases:
CVE-2026-75595
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext ### Summary A fragmented TLS ClientHello whose …
4.2.17.Final
Not vulnerable
4.2.17.Final
Not vulnerable
CVE-2026-75596
Aliases:
GHSA-fccg-mwvh-qqg4
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing Netty's default SNI entrypoint reparses and recopies previously … There are no reported fixed by versions.
CVE-2026-75595
Aliases:
GHSA-c4c3-7fpv-j4q5
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext A fragmented TLS ClientHello whose handshake header … There are no reported fixed by versions.
CVE-2026-62243
Aliases:
GHSA-p85m-gvr3-788c
Improper Validation of Certificate with Host Mismatch Netty disables TLS hostname verification on the `SslProvider.OPENSSL` client path when a plain … There are no reported fixed by versions.
This package is not known to fix any advisories.