netty

Latest vulnerabilities

• CVE-2026-100666 CVSS 6.9 medium Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including…
• CVE-2026-100665 CVSS 8.7 high Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification…
• CVE-2026-100664 CVSS 8.7 high Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header…
• CVE-2026-100663 CVSS 8.7 high Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT…
• CVE-2026-100662 CVSS 8.7 high Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption…
• CVE-2026-100661 CVSS 8.7 high Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in…
• CVE-2026-100660 CVSS 8.7 high Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state…
• CVE-2026-100659 CVSS 6.9 medium Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement…
• CVE-2026-89044 CVSS 6.9 medium Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer…
• CVE-2026-75596 CVSS 8.7 high Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default…
• CVE-2026-75595 CVSS 9.1 critical Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final…
• CVE-2026-59903 CVSS 7.5 high Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final…