Skip to contentNetty vulnerabilities
Newest
- nettyNetty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory ExhaustionCVE-2026-56745Fix available8.7 High
- nettyNetty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory ExhaustionCVE-2026-55851Fix available8.7 High
- nettyNetty SPDY zlib header block continues decoded expansion after maxHeaderSize truncationCVE-2026-55833Fix available7.5 High
- nettyNetty SPDY SETTINGS frame count materializes unbounded settings mapCVE-2026-55831Fix available7.5 High
- nettyNetty susceptible to HTTP/2 Reset Attack with different on-the-wire signatureCVE-2026-50560Fix available6.9 Medium
- nettyNetty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permittedCVE-2026-50020Fix available5.3 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty has unbounded pre-allocation in RedisArrayAggregator from RESP array lengthCVE-2026-50011Public exploitFix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty's wrapping plain trust manager silently disables hostname verificationCVE-2026-50010Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 moreNetty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionCVE-2026-48059Fix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +24 more +26 morenetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionCVE-2026-48043Fix available5.3 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorCVE-2026-48006Fix available8.7 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty has Insufficient Bailiwick Validation for NS RecordsCVE-2026-47691Fix available8.7 High
- nettyNetty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforcedCVE-2026-47244Fix available5.3 Medium
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +8 more +10 moreNetty: SCTP reassembly nests buffers without boundCVE-2026-46340Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsCVE-2026-45674Public exploitFix available8.7 High
- nettyNetty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source PortCVE-2026-45673Fix available6.8 Medium
- nettyNetty: Unix-socket fd receive leaks descriptors when peer sends two at onceCVE-2026-45536Fix available4.0 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty: SNI handler pre-allocates up to 16 MiB from nine attacker bytesCVE-2026-45416Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +23 more +25 moreNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthCVE-2026-44893Fix available7.5 High
- nettyNetty: Denial of Service via Unbounded Headers in StompSubframeDecoderCVE-2026-44891Fix available7.5 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty has Unbounded Direct Memory Consumption in its RedisDecoderCVE-2026-44890Fix available7.5 High
- netty, red hat build of apache camel 4.18.1.p1 for spring boot 3.5.16, data grid 8.6.2 +7 more +9 moreNetty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested ArraysCVE-2026-44250Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +33 more +35 moreNetty has an IPv6 Subnet Filter Bypass via Incorrect Comparator MaskingCVE-2026-44249Fix available8.1 High
- netty, io.netty netty-codec-mqtt, red hat amq broker 7.13.6 +8 more +10 moreNetty: Resource exhaustion in MqttDecoderCVE-2026-44248Fix available5.3 Medium
- netty, io.netty netty-codec-http, netty-codec-http2 +37 more +39 moreNetty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoSCVE-2026-42587Fix available7.5 High
- netty, io.netty netty-codec-redis +1 moreNetty: CRLF Injection in Netty Redis Codec EncoderCVE-2026-42586Fix available6.8 Medium
- netty, io.netty netty-codec-http +1 moreNetty: HTTP Request Smuggling due to malformed Transfer-EncodingCVE-2026-42585Fix available6.5 Medium
- netty, io.netty netty-codec-http, red hat cryostat 4 on rhel 9 +33 more +35 moreNetty: HttpClientCodec response desynchronizationCVE-2026-42584Fix available7.3 High
- netty, io.netty netty-codec, netty-codec-compression +2 moreNetty: Lz4FrameDecoder resource exhaustionCVE-2026-42583Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationCVE-2026-42581Fix available5.8 Medium
- netty, io.netty netty-codec-http +1 moreNetty: HTTP Request Smuggling due to incorrect chunk size parsingCVE-2026-42580Fix available6.5 Medium
- netty, red hat cryostat 4 on rhel 9, openshift serverless +28 more +30 moreNetty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)CVE-2026-42579Fix available7.5 High
- netty, red hat cryostat 4 on rhel 9, openshift serverless +32 more +34 moreNetty: HTTP Header Injection via HttpProxyHandler Disabled ValidationCVE-2026-42578Fix available2.9 Low
- nettyNetty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()CVE-2026-41417Fix available5.3 Medium
- netty, red hat cryostat 4, cryostat 4 on rhel 9 +37 more +39 moreNetty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassCVE-2026-33871Public exploitFix available8.7 High
- netty, red hat cryostat 4 on rhel 9, logging subsystem for red hat openshift +33 more +35 moreNetty: HTTP Request Smuggling via Chunked Extension Quoted-String ParsingCVE-2026-33870Fix available7.5 High
- nettyNetty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoderCVE-2025-67735Fix available6.5 Medium
- nettyNetty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email ForgeryCVE-2025-59419Fix available5.5 Medium
- nettyNetty's BrotliDecoder is vulnerable to DoS via zip bomb style attackCVE-2025-58057Fix available6.9 Medium
- nettyNetty is vulnerable to request smuggling due to incorrect parsing of chunk extensionsCVE-2025-58056Fix available2.9 Low
- nettyNetty MadeYouReset HTTP/2 DDoS VulnerabilityCVE-2025-55163Public exploitFix available8.2 High
- nettyDenial of Service attack on windows app using NettyCVE-2025-25193Fix available5.5 Medium
- netty, netapp active iq unified manager, oncommand insight +2 moreSslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngineCVE-2025-24970Fix available7.5 High
- nettyDenial of Service attack on windows app using NettyCVE-2024-47535Fix available5.5 Medium
- netty, debian linux +1 moreNetty HttpPostRequestDecoder can OOMCVE-2024-29025Fix available5.3 Medium
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- nettynetty-handler SniHandler 16MB allocationCVE-2023-34462Fix available6.5 Medium
- netty, debian linux +1 moreNetty vulnerable to HTTP Response splitting from assigning header value iteratorCVE-2022-41915Fix available6.5 Medium
- netty, debian linux +1 moreHAProxyMessageDecoder Stack Exhaustion DoSCVE-2022-41881Fix available5.3 Medium
- netty, netapp active iq unified manager, oncommand workflow automation +2 more +4 moreLocal Information Disclosure Vulnerability in io.netty:netty-codec-httpCVE-2022-24823Fix available5.5 Medium
- Show moreLoading…