60 matches found
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63202 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63202 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-19428722...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2024-40642 +1 more via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2024-40642, CVE-2026-63202 Source advisory: OSV:GHSA-4899-MPCH-38P3...
GHSA-4899-MPCH-38P3 netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding - ID: BHTTP-LOOP-001 - Severity: High - CVSS v3.1: 7.5 — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CWE: CWE-835 Loop with Unreachable Exit Condition — secondary CWE-400 Uncontrolled Resource...
GHSA-HMQ9-67W8-J5PW netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61827 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61827 Source advisory: GHSA-HMQ9-67W8-J5PW...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61827 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61827 Source advisory: OSV:GHSA-HMQ9-67W8-J5PW...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61827 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61827 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-19428728...
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
We don't enforce any limits for the encoded variable lengths that are used for fields. As the remote peer controls these it's easy for the remote peer to have us buffer data forever and so ultimately OOM...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63124 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63124 Source advisory: GHSA-8CFX-WX3Q-MH5Q...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63124 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63124 Source advisory: OSV:GHSA-8CFX-WX3Q-MH5Q...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63124 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63124 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-19428726...
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
Summary io.netty.incubator:netty-incubator-codec-bhttp uses attacker-controlled Binary HTTP variable-length integers as long values but accumulates them into int offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked ArrayIndexOutOfBoundsException /...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61799 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61799 Source advisory: GHSA-PGRF-4654-3GQ8...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61799 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61799 Source advisory: OSV:GHSA-PGRF-4654-3GQ8...
io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61799 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61799 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-19428725...
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...
io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.22.final) potentially affected by CVE-2026-61798 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.22.final Source cves: CVE-2026-61798 Source advisory: OSV:GHSA-2MC4-J865-9Q4R...
io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.22.final) potentially affected by CVE-2026-61798 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.22.final Source cves: CVE-2026-61798 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-19428717...
GHSA-2MC4-J865-9Q4R netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Summary io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString renders...
io.netty.incubator:netty-incubator-codec-ohttp-hpke-native-boringssl (>=0.0.3.final, <=0.0.22.final) potentially affected by CVE-2026-61798 via io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl (>=0.0.3.final, <=0.0.22.final)
io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl MAVEN version =0.0.3.final, =0.0.3.final, =0.0.22.final Source cves: CVE-2026-61798 Source advisory: GHSA-2MC4-J865-9Q4R...