io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61799 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61799 Source advisory: SNYK:JAVA-IONETTYINCUBATOR-19428725...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.22.final) potentially affected by CVE-2026-61799 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.22.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.22.final Source cves: CVE-2026-61799 Source advisory: GHSA-PGRF-4654-3GQ8...

Incorrect Conversion between Numeric Types

Overview Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the BinaryHttpParser process. An attacker can cause the decoder to crash and disrupt service availability by sending a specially crafted Binary HTTP payload with large variable-length intege...

PT-2026-80248

Summary io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can us...

PT-2026-80782

Summary io.netty.incubator:netty-incubator-codec-bhttp uses attacker-controlled Binary HTTP variable-length integers as long values but accumulates them into int offsets. Large valid varint lengths wrap the internal offset negative, leading to unchecked ArrayIndexOutOfBoundsException /...

PT-2026-80785

Summary io.netty.incubator:netty-incubator-codec-bhttp can enter a non-terminating parse loop when a known-length Binary HTTP field section ends exactly after a complete field line. A remote peer that can send Binary HTTP input to a Netty pipeline using BinaryHttpParser / BinaryHttpDecoder can us...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.12.final) potentially affected by CVE-2024-40642 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.12.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.12.final Source cves: CVE-2024-40642 Source advisory: MEND:CVE-2024-40642...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.12.final) potentially affected by CVE-2024-40642 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.12.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.12.final Source cves: CVE-2024-40642 Source advisory: OSV:GHSA-Q8F2-HXQ5-CP4H...

io.netty.incubator:netty-incubator-codec-ohttp (>=0.0.1.final, <=0.0.12.final) potentially affected by CVE-2024-40642 via io.netty.incubator:netty-incubator-codec-bhttp (>=0.0.1.final, <=0.0.12.final)

io.netty.incubator:netty-incubator-codec-bhttp MAVEN version =0.0.1.final, =0.0.1.final, =0.0.12.final Source cves: CVE-2024-40642 Source advisory: GHSA-Q8F2-HXQ5-CP4H...