CVE-2026-100656

Removed by vendor...

CVE-2026-100655

A flaw in Netty (specifically io.netty:netty-codec-http) allows a remote attacker to cause a Denial of Service (DoS) by exhausting server memory. The SpdySessionHandler defaults the localConcurrentStreams limit to Integer.MAX_VALUE without providing an API to restrict it. An attacker can open a S...

EUVD-2026-87749

Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...

CVE-2026-100655

...

CVE-2026-100655 Netty before 4.1.138.Final Denial of Service via SpdySessionHandler

Netty io.netty:netty-codec-http versions up to and including 4.1.137.Final and from 4.2.0.Final through 4.2.17.Final accept an unlimited number of concurrent remote-initiated SPDY streams: SpdySessionHandler defaults localConcurrentStreams to Integer.MAXVALUE and exposes no API to change it. A...

CVE-2026-100655

...

PT-2026-99332

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final Description A denial-of-service issue exists in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger that fails to bound the number of continuation bytes processed. A...

PT-2026-99334

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final Description The HTTP/3 codec fails to properly handle HTTP/1 CONNECT authority-form request-targets during the conversion of HTTP/1 messages to HTTP/3 within the toHttp3Headers functi...

PT-2026-99329

Name of the Vulnerable Software and Affected Versions Netty io.netty:netty-codec-http versions 4.1.88.Final through 4.1.137.Final Netty io.netty:netty-codec-http versions 4.2.0.Final through 4.2.17.Final Description An unbounded per-connection queue exists in the WebSocketServerExtensionHandler...

CVE-2026-100659: Inconsistent Interpretation of HTTP Requests

Netty's HTTP/3 codec io.netty:netty-codec-http3 in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated peer can send a single...

PT-2026-99335

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final Description The HTTP/3 codec incorrectly builds the :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. Th...

CVE-2026-100664: Improper Input Validation

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In HttpConversionUtil.toHttp3HeadersHttpMessage, boolean —...

CVE-2026-100662: Uncontrolled Resource Consumption

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02...

CVE-2026-100661: Uncontrolled Resource Consumption

Netty's HTTP/3 codec io.netty:netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder QpackUtil.decodePrefixedInteger, which does not bound the number of continuation bytes it will process. A remote, unauthenticat...

CVE-2026-100663: Improper Input Validation

Netty's HTTP/3 codec io.netty:netty-codec-http3 from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target e.g., "CONNECT trusted.example:443" i...

PT-2026-99330

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final Description The HTTP/3 codec fails to enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field must carry the same value when both are...

PT-2026-99327

Name of the Vulnerable Software and Affected Versions Netty io.netty:netty-codec-http versions 4.2.0.Final through 4.2.17.Final Netty io.netty:netty-codec-http versions prior to 4.1.138.Final Description An unbounded per-connection queue growth flaw exists in the HttpServerCodec. The codec tracks...

PT-2026-99331

Name of the Vulnerable Software and Affected Versions netty-codec-http3 versions 4.2.0.Final through 4.2.17.Final Description The HTTP/3 codec retains unbounded per-stream QPACK encoder state. The QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that...

io.netty/netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder

A flaw was found in Netty's XmlFrameDecoder component. An unauthenticated remote attacker could send specially crafted XML closing-tag sequences. This could cause the system to repeatedly rescan accumulated data, leading to high CPU utilization and a denial of service DoS...

SUSE CVE-2026-93574

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...