Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

netty — Vulnerabilities & Security Advisories 93

All 93 CVE vulnerabilities found in netty, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities for the Netty project, focusing on common weakness classifications tracked within the industry. It collects a comprehensive list of security flaws affecting Netty, covering public disclosures and vendor advisories released over the last several years. The data includes issues related to memory management, buffer handling, and protocol parsing errors that have been identified and remediated by the development team. By reviewing this content, users can effectively track the security advisory history associated with the Netty framework and understand the evolution of specific weakness classes within this widely used networking library. The page serves as a historical reference, allowing developers and security analysts to look up the vulnerability history of the product to assess past risks and the effectiveness of subsequent patches. This information is crucial for maintaining secure implementations, as it provides context on how certain types of exploits have been addressed in previous releases. Users interested in the long-term stability and security posture of Netty can use this aggregation to identify patterns in reported defects or to verify the resolution status of specific issue categories. The collection aims to provide a clear, factual overview without speculation, ensuring that technical teams have reliable data when conducting risk assessments or planning security updates for systems relying on Netty for non-blocking I/O operations.

Vendor: netty

CVE ID Title CVSS Severity Published
CVE-2026-56817 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled CWE-611 - - 2026-07-21
CVE-2026-56816 Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types CWE-400 7.5 High 2026-07-21
CVE-2026-56746 Netty has a Security Control Bypass via CORS Short-Circuit Failure CWE-284 6.5 Medium 2026-07-21
CVE-2026-56745 Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion CWE-400 - - 2026-07-21
CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion CWE-400 8.7 High 2026-07-21
CVE-2026-55833 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation CWE-400 7.5 High 2026-07-20
CVE-2026-55831 Netty SPDY SETTINGS frame count materializes unbounded settings map CWE-770 7.5 High 2026-07-20
CVE-2026-44891 Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder CWE-400 7.5 High 2026-07-17
CVE-2026-50560 Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature CWE-770 - - 2026-06-12
CVE-2026-50020 Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted CWE-444 5.3 Medium 2026-06-12
CVE-2026-50011 Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length CWE-400 7.5 High 2026-06-12
CVE-2026-50010 Netty's wrapping plain trust manager silently disables hostname verification CWE-347 7.5 High 2026-06-12
CVE-2026-50009 Netty QUIC stateless reset token material exposed through header-visible connection IDs CWE-200 4.8 Medium 2026-06-12
CVE-2026-48748 Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion CWE-770 7.5 High 2026-06-12
CVE-2026-48059 Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion CWE-401 8.7 High 2026-06-12
CVE-2026-48043 netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion CWE-400 5.3 Medium 2026-06-12
CVE-2026-48006 Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator CWE-401 8.7 High 2026-06-12
CVE-2026-47691 Netty has Insufficient Bailiwick Validation for NS Records CWE-345 8.7 High 2026-06-12
CVE-2026-47244 Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced CWE-400 5.3 Medium 2026-06-12
CVE-2026-46340 Netty: SCTP reassembly nests buffers without bound CWE-770 7.5 High 2026-06-12
CVE-2026-45674 Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records CWE-345 8.7 High 2026-06-12
CVE-2026-45673 Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port CWE-330 6.8 Medium 2026-06-12
CVE-2026-45536 Netty: Unix-socket fd receive leaks descriptors when peer sends two at once CWE-200 4.0 Medium 2026-06-12
CVE-2026-45416 Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes CWE-770 7.5 High 2026-06-12
CVE-2026-44894 Netty's Default QUIC token handler accepts any client-supplied token CWE-940 7.5 High 2026-06-12
CVE-2026-44893 Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length CWE-703 7.5 High 2026-06-12
CVE-2026-44892 Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size CWE-400 7.5 High 2026-06-12
CVE-2026-44890 Netty has Unbounded Direct Memory Consumption in its RedisDecoder CWE-400 7.5 High 2026-06-11
CVE-2026-44250 Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays CWE-400 7.5 High 2026-06-11
CVE-2026-44249 Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking CWE-284 8.1 High 2026-06-11

All 93 known CVE vulnerabilities affecting netty with full Chinese analysis, references, and POCs where available.