Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

io.netty:netty

11 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11 · 4 medium
Registry
Maven Central

Advisories 11

  • CVE-2021-43797Medium 6.5

    HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

    Affected: all versions.

  • The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

    Affected: all versions.

  • The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocati

    Affected: all versions.

  • CVE-2021-21409Medium 5.9

    Possible request smuggling in HTTP/2 due missing validation of content-length

    Affected: all versions.

  • CVE-2021-21295Medium 5.9

    Possible request smuggling in HTTP/2 due missing validation

    Affected: all versions.

  • CVE-2021-21290Medium 6.2

    Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

    Affected: all versions.

  • HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with

    Affected: all versions.

  • HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr

    Affected: all versions.

  • Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads

    Affected: from 3.3.0.Final, through 4.0.0.Alpha8.

  • Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x…

    Affected: from 3.10.0, fixed in 3.10.3.Final; fixed in 3.9.8.Final.

  • WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19…

    Affected: from 3.6.0.Beta1, fixed in 3.6.9.Final; from 3.7.0.Final, fixed in 3.7.1.Final; from 3.8.0.Final, fixed in 3.8.2.Final; from 3.9.0.Final, fixed in 3.9.1.Final; from 4.0.0.Alpha1, fixed in 4.0.19.Final.