ROOT-APP-MAVEN-CVE-2026-59901 CVE-2026-59901 in io.netty:netty-codec - Patched by Root

Root has patched CVE-2026-59901 in the io.netty:netty-codec package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-55831 CVE-2026-55831 in io.netty:netty-codec-http - Patched by Root

Root has patched CVE-2026-55831 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-56819 CVE-2026-56819 in io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-56819 in the io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-55833 CVE-2026-55833 in io.netty:netty-codec-http - Patched by Root

Root has patched CVE-2026-55833 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...

netty-http2-check

netty-http2-check Offline checker for the 7io.netty:netty-codec-http2 CVEs. Tells you which ones you are actually exposed to — and the single version that fixes all of them: 4.1.136.Final / 4.2.16.Final, a number that appears on none of the seven advisories. CVE-2025-55163 · CVE-2026-33871 ·...

CVE-2026-100660

A flaw was found in Netty's HTTP/3 codec netty-codec-http3. The HTTP/3 header compression QPACK encoder stores per-stream state indefinitely when remote clients do not acknowledge encoded data, as no memory limits are enforced. A remote, unauthenticated attacker can exploit this flaw by issuing...

CVE-2026-100663

A flaw was found in Netty's HTTP/3 codec netty-codec-http3. A remote attacker can bypass security policies and tunnel allowlists when Netty acts as an HTTP/1 to HTTP/3 proxy or gateway. Due to improper translation of HTTP/1 CONNECT requests, the component uses the attacker-controlled Host header ...

Linux Distros Unpatched Vulnerability : CVE-2026-100655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent...

Linux Distros Unpatched Vulnerability : CVE-2026-100656

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty io.netty:netty-codec-http contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each...

CVE-2026-100664

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100663

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

DEBIAN-CVE-2026-100656

Bulletin has no description...

DEBIAN-CVE-2026-100657

Bulletin has no description...

CVE-2026-100658

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-100659

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

CVE-2026-100655

Rejected reason: This CVE ID has been rejected as a duplicate...

CVE-2026-100657

Rejected reason: This CVE ID has been rejected as a duplicate...

DEBIAN-CVE-2026-100655

Bulletin has no description...

CVE-2026-100656

Rejected reason: This CVE ID has been rejected as a duplicate...