CRLF Injection

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to CRLF Injection in HttpRequestEncoder, due to improper sanitization of a URI with line-breaks...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +42052 more potentially affected by CVE-2025-67735 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.128.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-67735...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.telosforge:kimaira-util-webclient (1.2.6) +2833 more potentially affected by CVE-2025-67735 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.7.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.10.6 and more Source cves: CVE-2025-67735 Source advisory: SNYK:JAVA-IONETTY-14423947...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.telosforge:kimaira-util-webclient (1.2.6) +2833 more potentially affected by CVE-2025-67735 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.7.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.9.0, =25.10.6 and more Source cves: CVE-2025-67735 Source advisory: GHSA-84H7-RJJ3-6JX4...

EUVD-2022-15674

Malicious code in bioql PyPI...

OESA-2025-2153 netty security update

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers clients. %package help Summary: Documents for Buildarch: noarch Requires: man info Provides: -javadoc = - Obsoletes: -javadoc - %description help Man pages a...

OESA-2025-2149 netty security update

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers clients. %package help Summary: Documents for Buildarch: noarch Requires: man info Provides: -javadoc = - Obsoletes: -javadoc - %description help Man pages a...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +41325 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.124.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-58056...

app.fmgp:did-framework_3 (>=0.1.0-m26, <=0.1.0-m35), app.fmgp:did-method-prism_3 (>=0.1.0-m26, <=0.1.0-m35) +1462 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.4.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0-m26, =0.1.0-m26, =1.0.5, =25.4.0, =25.4.0, =4.0.0-beta.1, =4.0.0-beta.5 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 - cn.hserver:hserver-plugin-forest 3.7.0...

app.fmgp:did-framework_3 (>=0.1.0-m26, <=0.1.0-m35), app.fmgp:did-method-prism_3 (>=0.1.0-m26, <=0.1.0-m35) +1462 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.4.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0-m26, =0.1.0-m26, =1.0.5, =25.4.0, =25.4.0, =4.0.0-beta.1, =4.0.0-beta.5 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 - cn.hserver:hserver-plugin-forest 3.7.0...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +41325 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.124.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-58056...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +41325 more potentially affected by CVE-2025-58057 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.124.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-58057...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the...

app.fmgp:did-framework_3 (>=0.1.0-m26, <=0.1.0-m35), app.fmgp:did-method-prism_3 (>=0.1.0-m26, <=0.1.0-m35) +1462 more potentially affected by CVE-2025-58057 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.4.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0-m26, =0.1.0-m26, =1.0.5, =25.4.0, =25.4.0, =4.0.0-beta.1, =4.0.0-beta.5 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 - cn.hserver:hserver-plugin-forest 3.7.0...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +41325 more potentially affected by CVE-2025-58057 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.124.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-58057...

app.fmgp:did-framework_3 (>=0.1.0-m26, <=0.1.0-m35), app.fmgp:did-method-prism_3 (>=0.1.0-m26, <=0.1.0-m35) +1462 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.4.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0-m26, =0.1.0-m26, =1.0.5, =25.4.0, =25.4.0, =4.0.0-beta.1, =4.0.0-beta.5 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 - cn.hserver:hserver-plugin-forest 3.7.0...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +41325 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.124.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-58056...

app.fmgp:did-framework_3 (>=0.1.0-m26, <=0.1.0-m35), app.fmgp:did-method-prism_3 (>=0.1.0-m26, <=0.1.0-m35) +1462 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.4.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.1.0-m26, =0.1.0-m26, =1.0.5, =25.4.0, =25.4.0, =4.0.0-beta.1, =4.0.0-beta.5 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 - cn.hserver:hserver-plugin-forest 3.7.0...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +41325 more potentially affected by CVE-2025-58056 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.124.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid 0.1.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 and more Source cves: CVE-2025-58056...

netty-codec-http: Allocation of Resources Without Limits or Throttling

A flaw was found in the io.netty:netty-codec-http package. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling issues due to the accumulation of data in the HttpPostRequestDecoder. The decoder cumulates bytes in the undecodedChunk buffer until ...