[ Vendor · 10 CVEs ]
netty
CVEs affecting netty published in the last 30 days, plus any netty CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100661 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK… | |
| CVE-2026-100662 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption… | |
| CVE-2026-100663 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form… | |
| CVE-2026-100664 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the… | |
| CVE-2026-100665 | 26 Sep 2026 | CVSS 7.5 | nettyNetty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when… | |
| CVE-2026-100666 | 26 Sep 2026 | CVSS 7.3 | nettyNetty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final… | |
| CVE-2026-100659 | 26 Sep 2026 | CVSS 6.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the… | |
| CVE-2026-100660 | 26 Sep 2026 | CVSS 7.5 | nettyNetty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state… | |
| CVE-2026-59901 | 29 Jul 2026 | CVSS 8.7 | nettyNetty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in… | |
| CVE-2026-42587 | 13 May 2026 | CVSS 7.5 | nettyNetty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a… |