ROOT-APP-MAVEN-CVE-2026-44249 CVE-2026-44249 in io.root.io.netty:netty-handler - Patched by Root

Root has patched CVE-2026-44249 in the io.root.io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-42579 CVE-2026-42579 in io.root.io.netty:netty-codec-dns - Patched by Root

Root has patched CVE-2026-42579 in the io.root.io.netty:netty-codec-dns package for Root:Maven. Multiple fixed versions available...

HTTP Request Smuggling io.netty:netty-codec-http Dependency in Bitbucket Data Center

This High severity io.netty:netty-codec-http Dependency vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0 of Bitbucket Data Center and Server. This HTTP Request Smuggling vulnerability, with a CVSS Score of 7.5 and a CVSS...

DoS (Denial of Service) with Netty Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...

HTTP Request Smuggling io.netty:netty-codec-http Dependency in Bitbucket Data Center

This High severity io.netty:netty-codec-http Dependency vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, 10.3.0 of Bitbucket Data Center and Server. This HTTP Request Smuggling vulnerability, with a CVSS Score of 7.5 and a CVSS...

DoS (Denial of Service) netty-codec-http2 Dependency in Bitbucket Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.0, 9.4.0, 9.5.0, 9.6.0, 10.0.0, 10.1.1, 10.2.0, and 10.3.0 of Bitbucket Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

The vulnerability of the `io.netty.handler.codec.http3.QpackDecoder` component in the Netty framework, which is used for developing network applications, servers, and clients. This vulnerability allows a attacker to cause a service failure.

The vulnerability of the io.netty.handler.codec.http3.QpackDecoder component in the Netty framework, which is used for developing network applications, servers, and clients, involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service...

CVE-2026-44891

creationtimestamp| type| source ---|---|--- 2026-07-14 22:35:11+00:00| published-proof-of-concept| https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp 2026-07-18 09:00:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqvvo6d5ep2j...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the StompSubframeDecoder process. An attacker can exhaust system memory and cause a server crash by sending a large number of short headers in a single STOMP frame, resulting ...

GHSA-VHCH-2WF3-M8RP Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

Summary The StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, allowing an attacker to cause an OutOfMemoryError, leading to a Denial of Service. Details io.netty.handler.codec.stomp.StompSubframeDecoder implements the STOMP protocol. The...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a HTTP Request Smuggling Vulnerability in Netty (CVE-2026-33870)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of the Server/Agent/Relay communication system. CVE-2026-33870. Vulnerability Details CVEID:CVE-2026-33870 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to...

ROOT-APP-MAVEN-CVE-2025-24970 CVE-2025-24970 in io.root.io.netty:netty-handler - Patched by Root

Root has patched CVE-2025-24970 in the io.root.io.netty:netty-handler package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-55163 CVE-2025-55163 in io.root.io.netty:netty-codec-http2 - Patched by Root

Root has patched CVE-2025-55163 in the io.root.io.netty:netty-codec-http2 package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-58057 CVE-2025-58057 in io.root.io.netty:netty-codec - Patched by Root

Root has patched CVE-2025-58057 in the io.root.io.netty:netty-codec package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-59419 CVE-2025-59419 in io.root.io.netty:netty-codec-smtp - Patched by Root

Root has patched CVE-2025-59419 in the io.root.io.netty:netty-codec-smtp package for Root:Maven. Multiple fixed versions available...

Security Bulletin: IBM Automation Decision Services for June 2026- Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Automation Decision Services. See full list below. Vulnerability Details CVEID:CVE-2026-29063 DESCRIPTION: Immutable.js provides many Persistent Immutable data...

PT-2026-61745

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.136.Final Netty versions prior to 4.2.16.Final Description An issue exists in the SPDY protocol implementation where header decoding continues inflating zlib-compressed header blocks even after the raw header parser...

The vulnerability of the `io.netty.handler.codec.redis.RedisEncoder` component in the framework for developing network applications, servers, and clients using the Netty protocol allows a hacker to inject arbitrary commands.

The vulnerability of the io.netty.handler.codec.redis.RedisEncoder component in the framework for developing network applications, servers, and clients using the Netty protocol is related to improper code generation. Exploiting this vulnerability allows a remote attacker to inject arbitrary...

The vulnerability of the DefaultHttp2FrameReader class in the framework for developing network applications, servers, and clients using the Netty protocol allows a attacker to cause a service failure.

The vulnerability of the DefaultHttp2FrameReader class in the network application development framework for protocols like Netty relates to the distribution of resources without any restrictions or regulation. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the framework for developing network applications, servers, and client protocols using Netty arises from deficiencies in HTTP request processing. This allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the framework for developing network applications, servers, and client protocols using Netty is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests remotely HTTP Request Smuggling attack...