Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

io.netty:netty-codec

5 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
4.2.20.Final (Nov 2, 2026): no advisory affects it
Newest unaffected release
4.2.20.Final (Nov 2, 2026), the latest release
Advisories
5 · 2 high, 1 medium
Dependents
61
Releases
267 since 4.0.0.Final (Jul 15, 2013)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-59901
    Affects 4.0.0.Alpha1 to 4.1.135.Final (4.1.136.Final is outside it)
  • CVE-2026-42583
    Affects 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it)
  • CVE-2025-58057
    Affects 4.0.0.Alpha1 to 4.1.124.Final (4.1.125.Final is outside it)
  • CVE-2021-37137
    Affects 4.0.0.Final to 4.1.67.Final (4.1.68.Final is outside it)
  • CVE-2021-37136
    Affects 4.0.0.Alpha1 to 4.1.67.Final (4.1.68.Final is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

    Affected: fixed in 4.1.136.Final.

    Fixed in 4.1.136.Final (released Jul 8, 2026, 21 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty: Lz4FrameDecoder resource exhaustion

    Affected: fixed in 4.1.133.Final.

    Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2025-58057Medium 6.9

    Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

    Affected: fixed in 4.1.125.Final.

    Fixed in 4.1.125.Final (released Sep 3, 2025, the day of disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

    Affected: from 4.0.0, fixed in 4.1.68.Final.

    Fixed in 4.1.68.Final (released Sep 9, 2021, 40 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocati

    Affected: fixed in 4.1.68.Final.

    Fixed in 4.1.68.Final (released Sep 9, 2021, 40 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.