ROOT-APP-MAVEN-CVE-2026-56745 CVE-2026-56745 in io.netty:netty-codec-http - Patched by Root

Root has patched CVE-2026-56745 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2026-100666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +43813 more potentially affected by CVE-2026-100666 via io.netty:netty-codec-http (>=4.0.0.alpha1, <=4.1.136.final)

io.netty:netty-codec-http MAVEN version =4.0.0.alpha1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the isContentAlwaysEmpty method of HttpServerCodec, which calls...

DEBIAN-CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666

Netty's HttpServerCodec io.netty:netty-codec-http in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod once per response, including for 1xx informational responses. If a client...

CVE-2026-100666

The io.netty:netty-codec-http component in Netty's HttpServerCodec is vulnerable in versions 4.2.0.Final through 4.2.16.Final and up to 4.1.136.Final . The root cause is that the codec pairs outbound responses with inbound requests by calling pollMethod() once per response, including 1xx informat...

EUVD-2026-87750

Netty io.netty:netty-codec-http contains an unbounded per-connection queue growth flaw in HttpServerCodec. The codec tracks the HTTP method of each still-unanswered pipelined request; the first 32 entries are bit-packed into a single long, but every additional entry is appended to...

CVE-2026-100656

...

CVE-2026-100655

Removed by vendor...

PT-2026-99326

Name of the Vulnerable Software and Affected Versions Netty io.netty:netty-codec-http versions prior to 4.1.138.Final Netty io.netty:netty-codec-http versions 4.2.0.Final through 4.2.17.Final Description The software accepts an unlimited number of concurrent remote-initiated SPDY streams because...

ac.intave:cloud-protocol (>=0.0.1, <=0.0.11), africa.absa:inception-application (>=1.0.0, <=1.2.0) +42655 more potentially affected by CVE-2026-93562 via io.netty:netty-codec-http (>=4.1.0.beta1, <=4.1.137.final)

io.netty:netty-codec-http MAVEN version =4.1.0.beta1, =0.0.1, =1.0.0, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0 and more Source cves:...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +6397 more potentially affected by CVE-2026-93562 via io.netty:netty-codec-http (>=4.2.0.final, <=4.2.17.final)

io.netty:netty-codec-http MAVEN version =4.2.0.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93562 Source advisory: MEND:CVE-2026-93562...

ai.catboost:catboost-spark_4.1_2.13 (1.2.10), ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7) +6412 more potentially affected by CVE-2026-93574 via io.netty:netty-codec-http (>=4.2.0.alpha1, <=4.2.17.final)

io.netty:netty-codec-http MAVEN version =4.2.0.alpha1, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.1.0, =0.1.0, =4.13.5, =4.9.0, =4.9.0, =4.5.0, =4.6.0 and more Source cves: CVE-2026-93574 Source advisory: MEND:CVE-2026-93574...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +25247 more potentially affected by CVE-2026-93574 via io.netty:netty-codec-http (>=4.1.90.final, <=4.1.137.final)

io.netty:netty-codec-http MAVEN version =4.1.90.final, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-cli_3 (>=0.3.0, <=0.5.7) +4887 more potentially affected by CVE-2026-93573 via io.netty:netty-codec-http (>=4.2.12.final, <=4.2.17.final)

io.netty:netty-codec-http MAVEN version =4.2.12.final, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =1.8.0, =1.8.0, =4.13.5, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.0, =4.9.2 and more Source cves: CVE-2026-93573 Source advisory: MEND:CVE-2026-93573...

ai.clarity.codeartifact:ai.clarity.codeartifact.gradle.plugin (>=0.1.2, <=0.2.2), ai.clarity:clarity-artifact (>=0.1.2, <=0.2.2) +7085 more potentially affected by CVE-2026-93573 via io.netty:netty-codec-http (>=4.1.132.final, <=4.1.137.final)

io.netty:netty-codec-http MAVEN version =4.1.132.final, =0.1.2, =0.1.2, =1.1.1, =0.1.3, =0.1.3, =0.3.0, =0.1.2, =0.1.3, =0.1.4, =0.3.0, =0.3.0, =0.3.0, =0.3.1 and more Source cves: CVE-2026-93573 Source advisory: MEND:CVE-2026-93573...

CVE-2026-93574

A flaw was found in Netty's netty-codec-http component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an...