ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +2921 more potentially affected by CVE-2026-41417 via io.netty:netty-codec-http (>=4.2.0.Alpha1 <=4.2.12.Final)

io.netty:netty-codec-http MAVEN version =4.2.0.Alpha1, =0.1.0, =0.1.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.2 and more Source cves: CVE-2026-41417 Source advisory: OSV:GHSA-V8H7-RR48-VMMV...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +23809 more potentially affected by CVE-2026-41417 via io.netty:netty-codec-http (>=4.0.0.Alpha1 <=4.1.132.Final)

io.netty:netty-codec-http MAVEN version =4.0.0.Alpha1, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the setUri function. An attacker can inject arbitrary CRLF sequenc...

Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection

Summary Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri. The constructors reject CRLF and whitespace characters that would break the start-line, but setUri does not apply the same...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +23809 more potentially affected by CVE-2026-41417 via io.netty:netty-codec-http (>=4.0.0.Alpha1 <=4.1.132.Final)

io.netty:netty-codec-http MAVEN version =4.0.0.Alpha1, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +2921 more potentially affected by CVE-2026-41417 via io.netty:netty-codec-http (>=4.2.0.Alpha1 <=4.2.12.Final)

io.netty:netty-codec-http MAVEN version =4.2.0.Alpha1, =0.1.0, =0.1.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.2 and more Source cves: CVE-2026-41417 Source advisory: SNYK:JAVA-IONETTY-16425695...

CVE-2026-42584

creationtimestamp| type| source ---|---|--- 2026-05-05 18:11:31+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3...

CVE-2026-42583

creationtimestamp| type| source ---|---|--- 2026-05-05 18:10:58+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6...

CVE-2026-42582

creationtimestamp| type| source ---|---|--- 2026-05-05 18:10:33+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw 2026-07-10 18:03:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcqcal5lt2e...

CVE-2026-42579

creationtimestamp| type| source ---|---|--- 2026-05-05 18:10:10+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm...

CVE-2026-42585

creationtimestamp| type| source ---|---|--- 2026-05-05 18:09:42+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv...

CVE-2026-42580

creationtimestamp| type| source ---|---|--- 2026-05-05 18:09:16+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723...

CVE-2026-42581

creationtimestamp| type| source ---|---|--- 2026-05-05 18:08:44+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9...

CVE-2026-42578

creationtimestamp| type| source ---|---|--- 2026-05-05 18:05:31+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr...

PT-2026-38360

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A resource exhaustion issue exists in the decode function of the io.netty.handler.codec.compression.Lz4FrameDecoder class. The decoder trusts header fields to determine buffer sizing,...

PT-2026-37246

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.133.Final Netty versions prior to 4.2.13.Final Description Request-line validation can be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created and its URI is subsequently modified using the setUri...

PT-2026-38372

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.133.Final Netty versions prior to 4.2.13.Final Description Netty's DNS codec fails to enforce RFC 1035 domain name constraints during encoding and decoding, creating a bidirectional attack surface. In the encoder, t...

io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass...

netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood

A flaw was found in Netty. A remote user can trigger a Denial of Service DoS against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server's lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume...

Security Bulletin:Netty CRLF Injection in HttpRequestEncoder: Request Smuggling Vulnerability Fixed in 4.1.129.Final and 4.2.8.Final

Summary Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the io.netty.handler.codec.http.HttpRequestEncoder has a CRLF injection with the request URI when constructing a request. This leads to request smuggling when...