Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

io.netty:netty-codec-compression

3 known vulnerabilities (2 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
4.2.20.Final (Nov 2, 2026): no advisory affects it
Newest unaffected release
4.2.20.Final (Nov 2, 2026), the latest release
Advisories
3 · 2 high, 1 medium
Dependents
1,841
Releases
29 since 4.2.0.Final (Apr 3, 2025)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-59901
    Affects 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
  • CVE-2026-42583
    Affects 4.2.0.Alpha3 to 4.2.12.Final (4.2.13.Final is outside it)
  • CVE-2025-58057
    Affects 4.2.0.Alpha3 to 4.2.4.Final (4.2.5.Final is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang

    Affected: from 4.2.0.Final, fixed in 4.2.16.Final.

    Fixed in 4.2.16.Final (released Jul 7, 2026, 22 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty: Lz4FrameDecoder resource exhaustion

    Affected: fixed in 4.2.13.Final.

    Fixed in 4.2.13.Final (released May 4, 2026, 9 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2025-58057Medium 6.9

    Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack

    Affected: from 4.2.0.Alpha1, fixed in 4.2.5.Final.

    Fixed in 4.2.5.Final (released Sep 3, 2025, the day of disclosure).

    The latest release, 4.2.20.Final, is not affected.