Denial-of-service (DoS)

io.netty.incubator is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of known-length Binary HTTP field sections that end immediately after a complete field line, which allows a remote attacker to send a specially crafted malformed Binary HTTP request or...

Sensitive Information Exposure

io.netty.incubator is vulnerable to sensitive information exposure. The vulnerability is due to private key bytes being included in string representations and exception messages, which allows an attacker with access to application logs to obtain exposed private key material and potentially use it...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-63124 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-63124 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-19428726...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.19.final), io.netty.incubator:netty-incubator-codec-ohttp-hpke-bouncycastle (>=0.0.3.final, <=0.0.19.final) +2 more potentially affected by CVE-2026-41207 via io.netty.incubator:netty-incubator-codec-ohttp-hpke (>=0.0.1.final, <=0.0.19.final)

io.netty.incubator:netty-incubator-codec-ohttp-hpke MAVEN version =0.0.1.final, =0.0.1.final, =0.0.3.final, =0.0.3.final, =0.0.3.final, =0.0.19.final Source cves: CVE-2026-41207 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-17263840...