Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

netty — Vulnerabilities & Security Advisories 93

All 93 CVE vulnerabilities found in netty, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security vulnerabilities for the Netty project, focusing on common weakness classifications tracked within the industry. It collects a comprehensive list of security flaws affecting Netty, covering public disclosures and vendor advisories released over the last several years. The data includes issues related to memory management, buffer handling, and protocol parsing errors that have been identified and remediated by the development team. By reviewing this content, users can effectively track the security advisory history associated with the Netty framework and understand the evolution of specific weakness classes within this widely used networking library. The page serves as a historical reference, allowing developers and security analysts to look up the vulnerability history of the product to assess past risks and the effectiveness of subsequent patches. This information is crucial for maintaining secure implementations, as it provides context on how certain types of exploits have been addressed in previous releases. Users interested in the long-term stability and security posture of Netty can use this aggregation to identify patterns in reported defects or to verify the resolution status of specific issue categories. The collection aims to provide a clear, factual overview without speculation, ensuring that technical teams have reliable data when conducting risk assessments or planning security updates for systems relying on Netty for non-blocking I/O operations.

Vendor: netty

CVE ID Title CVSS Severity Published
CVE-2026-44248 Netty: Resource exhaustion in MqttDecoder CWE-400 5.3 Medium 2026-05-13
CVE-2026-42587 Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS CWE-400 7.5 High 2026-05-13
CVE-2026-42586 Netty: CRLF Injection in Netty Redis Codec Encoder CWE-93 6.8 Medium 2026-05-13
CVE-2026-42585 Netty: HTTP Request Smuggling due to malformed Transfer-Encoding CWE-444 6.5 Medium 2026-05-13
CVE-2026-42584 Netty: HttpClientCodec response desynchronization CWE-444 7.3 High 2026-05-13
CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion CWE-400 7.5 High 2026-05-13
CVE-2026-42582 Netty: HTTP/3 QPACK literal unbounded allocation CWE-770 7.5 High 2026-05-13
CVE-2026-42580 Netty: HTTP Request Smuggling due to incorrect chunk size parsing CWE-444 6.5 Medium 2026-05-13
CVE-2026-42579 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CWE-20 7.5 High 2026-05-13
CVE-2026-42577 Netty: epoll transport denial of service via RST on half-closed TCP connection CWE-772 7.5 High 2026-05-13
CVE-2026-42578 Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation CWE-113 2.9 Low 2026-05-13
CVE-2026-42581 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CWE-444 5.8 Medium 2026-05-13
CVE-2026-41417 Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri() CWE-93 5.3 Medium 2026-05-06
CVE-2026-33871 Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass CWE-770 8.7 High 2026-03-27
CVE-2026-33870 Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CWE-444 7.5 High 2026-03-27
CVE-2025-67735 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder CWE-93 6.5 Medium 2025-12-16
CVE-2025-59419 Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery CWE-93 9.8 - 2025-10-15
CVE-2025-58057 Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack CWE-409 7.5AI High AI 2025-09-03
CVE-2025-58056 Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions CWE-444 7.4AI High AI 2025-09-03
CVE-2025-55163 Netty MadeYouReset HTTP/2 DDoS Vulnerability CWE-770 7.5AI High AI 2025-08-13
CVE-2025-25193 Denial of Service attack on windows app using Netty CWE-400 5.5 Medium 2025-02-10
CVE-2025-24970 SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine CWE-20 7.5 High 2025-02-10
CVE-2024-47535 Denial of Service attack on windows app using Netty CWE-400 5.5 Medium 2024-11-12
CVE-2024-29025 Netty HttpPostRequestDecoder can OOM CWE-770 5.3 Medium 2024-03-25
CVE-2023-34462 netty-handler SniHandler 16MB allocation CWE-400 6.5 Medium 2023-06-22
CVE-2022-41915 Netty 安全漏洞 CWE-436 6.5 Medium 2022-12-13
CVE-2022-41881 Netty 安全漏洞 CWE-674 5.3 Medium 2022-12-12
CVE-2022-24823 Local Information Disclosure Vulnerability in io.netty:netty-codec-http CWE-668 5.5 Medium 2022-05-06
CVE-2021-43797 HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling CWE-444 6.5 Medium 2021-12-09
CVE-2021-37137 Netty 资源管理错误漏洞 CWE-400 7.5 - 2021-10-19

All 93 known CVE vulnerabilities affecting netty with full Chinese analysis, references, and POCs where available.