netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood

A flaw was found in Netty. A remote user can trigger a Denial of Service DoS against a Netty HTTP/2 server by sending a flood of CONTINUATION frames. The server's lack of a limit on these frames, coupled with a bypass of size-based mitigations using zero-byte frames, allows an attacker to consume...

io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass...

HTTP Request Smuggling io.netty:netty-codec-http Dependency in Jira Software Data Center

This is a vulnerability in a non-Atlassian Jira dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This High severity HTTP Request Smuggling vulnerability was introduced in versions 9.12.1, 10.3.0, 11.3.0 of Jira Software Data Center and Jira...

DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.12.1, 9.15.2, 9.16.0, 9.17.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS...

Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.

Summary Multiple Vulnerabilities found in EDB PGAI products - 1 EDB PGAI AI Factory with IBM 1.3.0, 2 EDB PGAI Analytics Accelerator 1.3.0, and 3 EDB PGAI Hybrid Data Management 1.3.0. The vulnerabilities have been addressed in 1.3.4 version. Hence, IBM strongly recommends upgrading to 1.3.4...

Netty 注入漏洞

Netty is a non-blocking I/O client-server framework from the Netty community. It is primarily used for developing Java network applications, such as protocol servers and clients. Versions of Netty prior to 4.2.13.Final and 4.1.133.Final contained an injection vulnerability. This vulnerability...

PT-2026-38280

Name of the Vulnerable Software and Affected Versions Netty versions 4.2.0.Final through 4.2.12.Final Description Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed. This occurs when a connection has ALLOW HALF CLOSURE enabled or is in a...

Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection

Summary Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri. The constructors reject CRLF and whitespace characters that would break the start-line, but setUri does not apply the same...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the setUri function. An attacker can inject arbitrary CRLF sequenc...

GHSA-V8H7-RR48-VMMV Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection

Summary Netty allows request-line validation to be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created first and its URI is later changed via setUri. The constructors reject CRLF and whitespace characters that would break the start-line, but setUri does not apply the same...

CVE-2026-42584

creationtimestamp| type| source ---|---|--- 2026-05-05 18:11:31+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3...

CVE-2026-42583

creationtimestamp| type| source ---|---|--- 2026-05-05 18:10:58+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6...

CVE-2026-42582

creationtimestamp| type| source ---|---|--- 2026-05-05 18:10:33+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw 2026-07-10 18:03:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcqcal5lt2e...

CVE-2026-42579

creationtimestamp| type| source ---|---|--- 2026-05-05 18:10:10+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm...

CVE-2026-42585

creationtimestamp| type| source ---|---|--- 2026-05-05 18:09:42+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv...

CVE-2026-42580

creationtimestamp| type| source ---|---|--- 2026-05-05 18:09:16+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723...

CVE-2026-42581

creationtimestamp| type| source ---|---|--- 2026-05-05 18:08:44+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9...

CVE-2026-42578

creationtimestamp| type| source ---|---|--- 2026-05-05 18:05:31+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr...

PT-2026-38360

Name of the Vulnerable Software and Affected Versions Netty affected versions not specified Description A resource exhaustion issue exists in the decode function of the io.netty.handler.codec.compression.Lz4FrameDecoder class. The decoder trusts header fields to determine buffer sizing,...

PT-2026-37246

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.133.Final Netty versions prior to 4.2.13.Final Description Request-line validation can be bypassed when a DefaultHttpRequest or DefaultFullHttpRequest is created and its URI is subsequently modified using the setUri...