Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

netty — Vulnerabilities & Security Advisories 93

All 93 CVE vulnerabilities found in netty, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities for the Netty project, focusing on common weakness classifications tracked within the industry. It collects a comprehensive list of security flaws affecting Netty, covering public disclosures and vendor advisories released over the last several years. The data includes issues related to memory management, buffer handling, and protocol parsing errors that have been identified and remediated by the development team. By reviewing this content, users can effectively track the security advisory history associated with the Netty framework and understand the evolution of specific weakness classes within this widely used networking library. The page serves as a historical reference, allowing developers and security analysts to look up the vulnerability history of the product to assess past risks and the effectiveness of subsequent patches. This information is crucial for maintaining secure implementations, as it provides context on how certain types of exploits have been addressed in previous releases. Users interested in the long-term stability and security posture of Netty can use this aggregation to identify patterns in reported defects or to verify the resolution status of specific issue categories. The collection aims to provide a clear, factual overview without speculation, ensuring that technical teams have reliable data when conducting risk assessments or planning security updates for systems relying on Netty for non-blocking I/O operations.

Vendor: netty

CVE ID Title CVSS Severity Published
CVE-2026-100666 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec CWE-444 7.3 High 2026-09-26
CVE-2026-100665 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass CWE-295 7.5 High 2026-09-26
CVE-2026-100664 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion CWE-20 7.5 High 2026-09-26
CVE-2026-100663 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3 CWE-20 7.5 High 2026-09-26
CVE-2026-100662 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS CWE-400 7.5 High 2026-09-26
CVE-2026-100660 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention CWE-770 7.5 High 2026-09-26
CVE-2026-100661 Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation CWE-400 7.5 High 2026-09-26
CVE-2026-100659 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass CWE-444 6.5 Medium 2026-09-26
CVE-2026-89044 Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding CWE-444 6.5 Medium 2026-09-10
CVE-2026-76816 Netty: MQTT Topic Name and Client ID Validation Bypass CWE-20 3.5 Low 2026-08-24
CVE-2026-62380 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection CWE-626 6.3 Medium 2026-08-22
CVE-2026-62243 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass CWE-297 7.5 High 2026-08-22
CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CWE-754 9.1 Critical 2026-08-19
CVE-2026-75596 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing CWE-407 8.7 High 2026-08-19
CVE-2026-59903 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite CWE-524 6.5 Medium 2026-08-17
CVE-2026-59902 Netty: Memory Exhaustion in SctpMessageCompletionHandler CWE-400 7.5 High 2026-08-17
CVE-2026-73508 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names CWE-772 5.3 Medium 2026-08-13
CVE-2026-73507 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion CWE-400 7.5 High 2026-08-13
CVE-2026-56818 Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state CWE-401 6.5 Medium 2026-08-07
CVE-2026-59898 Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation CWE-444 6.3 Medium 2026-07-29
CVE-2026-59899 Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service CWE-770 6.9 Medium 2026-07-29
CVE-2026-59900 Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass CWE-444 6.9 Medium 2026-07-29
CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang CWE-835 8.7 High 2026-07-29
CVE-2026-59919 Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address CWE-93 5.5 Medium 2026-07-29
CVE-2026-59920 Netty: STOMP CONNECT Frame Header Injection CWE-93 6.5 Medium 2026-07-29
CVE-2026-56822 Netty: TOCTOU in OcspServerCertificateValidator CWE-367 7.4 High 2026-07-28
CVE-2026-56821 Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator CWE-299 7.4 High 2026-07-28
CVE-2026-59921 Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder CWE-93 5.7 Medium 2026-07-28
CVE-2026-56820 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CWE-295 7.4 High 2026-07-21
CVE-2026-56819 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) CWE-400 7.5 High 2026-07-21

All 93 known CVE vulnerabilities affecting netty with full Chinese analysis, references, and POCs where available.