at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1248 more potentially affected by CVE-2025-58057 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.4.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

at.aimit.mariella:persistence-kotlin (>=1.0.5, <=1.0.15), cloud.piranha.http:piranha-http-netty (>=25.4.0, <=25.6.0) +1145 more potentially affected by CVE-2025-55163 via io.netty:netty-codec-http2 (>=4.2.0.alpha1, <=4.2.3.final)

io.netty:netty-codec-http2 MAVEN version =4.2.0.alpha1, =1.0.5, =25.4.0, =25.4.0, =25.6.0 - cn.hserver:hserver 3.7.0 - cn.hserver:hserver-netty-web 4.0.0-beta.3 - cn.hserver:hserver-plugin-beetlsql 3.7.0 - cn.hserver:hserver-plugin-cloud 3.7.0 - cn.hserver:hserver-plugin-druid 3.7.0 -...

Security Bulletin: Netty-codec-http2 is vulnerable to CVE-2023-44487 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses netty-codec-http2 which is vulnerable to CVE-2023-44487. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: Multiple vendors are vulnerable to a denial of...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9

New Red Hat Single Sign-On 7.6.6 packages are now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: Red Hat Data Grid 8.4.5 security update

An update for Red Hat Data Grid 8 is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. Impact This is a DDOS attack, any http2 server is affected and so you should update as soon as possible. Patches This is patched in version...

openSUSE 15 Security Update : netty (SUSE-SU-2022:1315-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:1315-1 advisory. - Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers &...

HTTP Request Smuggling

netty-codec-http2 is vulnerable to HTTP request smuggling. The vulnerability exists through an incomplete fix in CVE-2021-21295 where the content-length header is not properly validated if the request uses a single Http2HeaderFrame, and with endStream set to true...

CVE-2021-21409

The CVE concerns Netty’s HTTP/2 codec (io.netty:netty-codec-http2) where, before version 4.1.61.Final, a Content-Length check can be bypassed when a single Http2HeaderFrame with endStream set to true is used. This enables HTTP request smuggling if the request is proxied and translated to HTTP/1.1...

CVE-2021-21409: Inconsistent Interpretation of HTTP Requests

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty io.netty:netty-codec-http2 before version 4.1.61.Final there is a vulnerability that enables request smuggling. The...

ai.api.libai.speech:libai-speech-gcp (>=1.4.6, <=1.6.12), ai.clarity.codeartifact:ai.clarity.codeartifact.gradle.plugin (>=0.0.1, <=0.0.10) +10652 more potentially affected by CVE-2021-21295 via io.netty:netty-codec-http2 (>=4.1.0.beta4, <=4.1.59.final)

io.netty:netty-codec-http2 MAVEN version =4.1.0.beta4, =1.4.6, =0.0.1, =0.0.1, =0.5.0, =0.0.1, =0.0.14, =1.3.0, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

CVE-2021-21295: Inconsistent Interpretation of HTTP Requests

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty io.netty:netty-codec-http2 before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a...

PT-2021-5814

Name of the Vulnerable Software and Affected Versions io.netty:netty-codec-http2 versions prior to 4.1.60.Final Description The issue is related to the handling of HTTP/2 requests in the Netty framework, specifically when the Content-Length header is present. If a request comes in as an HTTP/2...