Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

io.netty.incubator:netty-incubator-codec-ohttp

4 known vulnerabilities (1 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
0.0.28.Final (Sep 28, 2026): no advisory affects it
Newest unaffected release
0.0.28.Final (Sep 28, 2026), the latest release
Advisories
4 · 1 high, 3 medium
Dependents
0
Releases
28 since 0.0.1.Final (Dec 11, 2023)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-54251
    Affects 0.0.1.Final to 0.0.22.Final (0.0.23.Final is outside it)
  • CVE-2026-48480
    Affects 0.0.1.Final to 0.0.21.Final (0.0.22.Final is outside it)
  • CVE-2026-41207
    Affects 0.0.1.Final to 0.0.20.Final (0.0.21.Final is outside it)
  • CVE-2024-36121
    Affects 0.0.3.Final to 0.0.10.Final (0.0.11.Final is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service

    Affected: fixed in 0.0.23.Final.

    Fixed in 0.0.23.Final (released Jul 1, 2026, 76 days before disclosure).

    The latest release, 0.0.28.Final, is not affected.

  • CVE-2026-48480Medium 6.6

    netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation

    Affected: fixed in 0.0.22.Final.

    Fixed in 0.0.22.Final (released Jun 3, 2026, 1 day before disclosure).

    The latest release, 0.0.28.Final, is not affected.

  • CVE-2026-41207Medium 6.9

    netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures

    Affected: fixed in 0.0.21.Final.

    Fixed in 0.0.21.Final (released May 6, 2026, 29 days before disclosure).

    The latest release, 0.0.28.Final, is not affected.

  • CVE-2024-36121Medium 5.9

    netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces

    Affected: from 0.0.3.Final, fixed in 0.0.11.Final.

    Fixed in 0.0.11.Final (released Jun 4, 2024, the day of disclosure).

    The latest release, 0.0.28.Final, is not affected.