netty-http-check

netty-http-check Offline checker for the 14io.netty:netty-codec-http CVEs 2025–2026. Tells you which ones you are actually exposed to — and the single version that clears all of them: 4.1.137.Final / 4.2.17.Final, a number written on none of the fourteen advisories. CVE-2025-58056 · CVE-2025-6773...

CVE-2026-54251

netty-incubator-codec-ohttp is a Netty incubator library implementing Oblivious HTTP (OHTTP) gateway and client functionality. Prior to 0.0.23.Final , the OHTTP gateway decryption path allocates a pooled direct (native off-heap) ByteBuf for decrypted plaintext before the AEAD tag is verified. Whe...

netty-http2-check

netty-http2-check Offline checker for the 7io.netty:netty-codec-http2 CVEs. Tells you which ones you are actually exposed to — and the single version that fixes all of them: 4.1.136.Final / 4.2.16.Final, a number that appears on none of the seven advisories. CVE-2025-55163 · CVE-2026-33871 ·...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling due to incomplete validation of request Transfer-Encoding headers. An...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message

A flaw was found in Netty's codec-haproxy module. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service DoS due to memory exhaustion...

netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...

netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification

A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to...

netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message

A flaw was found in netty-codec-haproxy, a component of the Netty network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy message with a malformed PP2TYPESSL TLV Type-Length-Value header. This can lead to an IndexOutOfBoundsException...

ROOT-APP-MAVEN-CVE-2026-33870 CVE-2026-33870 in io.netty:netty-codec-http - Patched by Root

Root has patched CVE-2026-33870 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42579 CVE-2026-42579 in io.netty:netty-codec-dns - Patched by Root

Root has patched CVE-2026-42579 in the io.netty:netty-codec-dns package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-59419 CVE-2025-59419 in io.netty:netty-codec-smtp - Patched by Root

Root has patched CVE-2025-59419 in the io.netty:netty-codec-smtp package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42584 CVE-2026-42584 in io.netty:netty-codec-http - Patched by Root

Root has patched CVE-2026-42584 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-55831 CVE-2026-55831 in io.netty:netty-codec-http - Patched by Root

Root has patched CVE-2026-55831 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-41417 CVE-2026-41417 in io.netty:netty-codec-http - Patched by Root

Root has patched CVE-2026-41417 in the io.netty:netty-codec-http package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-50560 CVE-2026-50560 in io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-50560 in the io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-48043 CVE-2026-48043 in io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-48043 in the io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-47244 CVE-2026-47244 in io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2026-47244 in the io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...