Netty vulnerabilities

Products

• Netty 104
• Netty-incubator-codec-ohttp 6
• Netty-tcnative 4
• Netty-tcnative-boringssl-static 3

Newest

• netty netty-tcnative, netty-tcnative-boringssl-static +1 more Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding CVE-2026-116542 Fix available 6.9 MediumOctober 26, 2026
• netty netty-tcnative, netty-tcnative-boringssl-static +1 more netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount CVE-2026-116541 Fix available 8.2 HighOctober 26, 2026
• netty netty-tcnative netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback CVE-2026-116540 Fix available 8.2 HighOctober 26, 2026
• netty netty-tcnative, netty-tcnative-boringssl-static +1 more Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO CVE-2026-116539 Fix available 8.2 HighOctober 26, 2026
• netty Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec CVE-2026-100666 6.9 MediumSeptember 26, 2026
• netty Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CVE-2026-100665 8.7 HighSeptember 26, 2026
• netty Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion CVE-2026-100664 8.7 HighSeptember 26, 2026
• netty Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3 CVE-2026-100663 8.7 HighSeptember 26, 2026
• netty Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CVE-2026-100662 8.7 HighSeptember 26, 2026
• netty Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation CVE-2026-100661 8.7 HighSeptember 26, 2026
• netty Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention CVE-2026-100660 8.7 HighSeptember 26, 2026
• netty Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass CVE-2026-100659 6.9 MediumSeptember 26, 2026
• netty Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding CVE-2026-89044 Fix available 6.9 MediumSeptember 10, 2026
• netty Netty: MQTT Topic Name and Client ID Validation Bypass CVE-2026-76816 Fix available 3.5 LowAugust 24, 2026
• netty Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection CVE-2026-62380 Fix available 6.3 MediumAugust 22, 2026
• netty Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass CVE-2026-62243 Fix available 8.7 HighAugust 22, 2026
• io.netty.incubator netty-incubator-codec-ohttp netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service CVE-2026-54251 Fix available 8.7 HighAugust 20, 2026
• netty Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-75595 Fix available 9.1 CriticalAugust 19, 2026
• netty Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing CVE-2026-75596 Fix available 8.7 HighAugust 19, 2026
• netty Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite CVE-2026-59903 Public exploitFix available 6.5 MediumAugust 17, 2026
• netty Netty: Memory Exhaustion in SctpMessageCompletionHandler CVE-2026-59902 Fix available 7.5 HighAugust 17, 2026
• netty Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types CVE-2026-56816 Fix available 7.5 HighJuly 21, 2026
• netty Netty QUIC stateless reset token material exposed through header-visible connection IDs CVE-2026-50009 Fix available 4.8 MediumJune 12, 2026
• netty, red hat build of apache camel - hawtio 4 +1 more Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion CVE-2026-48748 Fix available 7.5 HighJune 12, 2026
• netty, red hat build of apache camel - hawtio 4 +1 more Netty's Default QUIC token handler accepts any client-supplied token CVE-2026-44894 Fix available 7.5 HighJune 8, 2026
• netty Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size CVE-2026-44892 Fix available 7.5 HighJune 8, 2026
• netty netty-incubator-codec-ohttp netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation CVE-2026-48480 Fix available 6.6 MediumJune 4, 2026
• netty netty-incubator-codec-ohttp netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access CVE-2026-48040 Fix available 6.8 MediumJune 4, 2026
• netty netty-incubator-codec-ohttp netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures CVE-2026-41207 Fix available 6.9 MediumMay 26, 2026
• netty, io.netty netty-codec-http3 +1 more Netty: HTTP/3 QPACK literal unbounded allocation CVE-2026-42582 Fix available 7.5 HighMay 7, 2026
• netty Netty: epoll transport denial of service via RST on half-closed TCP connection CVE-2026-42577 Fix available 7.5 HighMay 6, 2026
• netty netty-incubator-codec-quic Netty QUIC hash collision DoS attack CVE-2025-29908 Fix available 5.3 MediumMarch 31, 2025
• netty netty-incubator-codec-ohttp Absent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp CVE-2024-40642 Fix available 8.1 HighJuly 18, 2024
• netty netty-incubator-codec-ohttp netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces CVE-2024-36121 Fix available 5.9 MediumJune 4, 2024
• netty Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names CVE-2026-73508 Fix available 5.3 MediumOctober 10, 2023
• netty Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion CVE-2026-73507 Fix available 7.5 HighOctober 10, 2023
• netty Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder CVE-2026-59921 Fix available 5.7 MediumOctober 10, 2023
• netty Netty: STOMP CONNECT Frame Header Injection CVE-2026-59920 Fix available 6.5 MediumOctober 10, 2023
• netty Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address CVE-2026-59919 Fix available 5.5 MediumOctober 10, 2023
• netty Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang CVE-2026-59901 Fix available 8.7 HighOctober 10, 2023
• netty Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass CVE-2026-59900 Fix available 6.9 MediumOctober 10, 2023
• netty Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service CVE-2026-59899 Fix available 6.9 MediumOctober 10, 2023
• netty Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation CVE-2026-59898 Fix available 6.3 MediumOctober 10, 2023
• netty Netty: TOCTOU in OcspServerCertificateValidator CVE-2026-56822 Fix available 7.4 HighOctober 10, 2023
• netty Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator CVE-2026-56821 Fix available 7.4 HighOctober 10, 2023
• netty Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVE-2026-56820 Fix available 7.4 HighOctober 10, 2023
• netty Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) CVE-2026-56819 Public exploitFix available 7.5 HighOctober 10, 2023
• netty Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state CVE-2026-56818 Fix available 6.5 MediumOctober 10, 2023
• netty Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled CVE-2026-56817 Fix available 8.3 HighOctober 10, 2023
• netty Netty has a Security Control Bypass via CORS Short-Circuit Failure CVE-2026-56746 Fix available 6.5 MediumOctober 10, 2023
• Show olderLoading…