Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

io.netty:netty-codec-http

24 known vulnerabilities (6 high, 16 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
4.2.20.Final (Nov 2, 2026): no advisory affects it
Newest unaffected release
4.2.20.Final (Nov 2, 2026), the latest release
Advisories
24 · 6 high, 16 medium, 1 low
Dependents
29
Releases
267 since 4.0.0.Final (Jul 15, 2013)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-59903
    Affects 4.0.0.Alpha1 to 4.1.136.Final (4.1.137.Final is outside it); 4.2.0.Final to 4.2.16.Final (4.2.17.Final is outside it)
  • CVE-2026-59898
    Affects 4.0.0.Alpha1 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
  • CVE-2026-59899
    Affects 4.0.0.Alpha1 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
  • CVE-2026-59921
    Affects 4.0.0.Alpha1 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
  • CVE-2026-56746
    Affects 4.0.0.Alpha1 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
  • CVE-2026-56745
    Affects 4.1.0.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
  • CVE-2026-55833
    Affects 4.1.0.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
  • CVE-2026-55831
    Affects 4.1.0.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
  • CVE-2026-50020
    Affects 4.0.0.Alpha1 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Final to 4.2.14.Final (4.2.15.Final is outside it)
  • CVE-2026-42587
    Affects 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it)
  • CVE-2026-42585
    Affects 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it)
  • CVE-2026-42584
    Affects 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it)
Show all 24 advisoriesShow fewer advisories
  • CVE-2026-42580
    Affects 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it)
  • CVE-2026-42581
    Affects 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it)
  • CVE-2026-41417
    Affects 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it)
  • CVE-2026-33870
    Affects 4.0.0.Alpha1 to 4.1.131.Final (4.1.132.Final is outside it); 4.2.0.Alpha1 to 4.2.9.Final (4.2.10.Final is outside it)
  • CVE-2025-67735
    Affects 4.0.0.Alpha1 to 4.1.128.Final (4.1.129.Final is outside it); 4.2.0.Alpha1 to 4.2.7.Final (4.2.8.Final is outside it)
  • CVE-2025-58056
    Affects 4.0.0.Alpha1 to 4.1.124.Final (4.1.125.Final is outside it); 4.2.0.Alpha1 to 4.2.4.Final (4.2.5.Final is outside it)
  • CVE-2024-29025
    Affects 4.0.0.Alpha1 to 4.1.107.Final (4.1.108.Final is outside it)
  • CVE-2022-41915
    Affects 4.1.83.Final to 4.1.85.Final (4.1.86.Final is outside it)
  • CVE-2022-24823
    Affects 4.0.0.Alpha1 to 4.1.76.Final (4.1.77.Final is outside it)
  • CVE-2021-43797
    Affects 4.0.0.Final to 4.1.70.Final (4.1.71.Final is outside it)
  • CVE-2021-21290
    Affects 4.0.0.Final to 4.1.58.Final (4.1.59.Final is outside it)
  • CVE-2019-20444
    Affects 4.0.0.Alpha1 to 4.1.43.Final (4.1.44.Final is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 24

  • CVE-2026-59903Medium 6.5

    Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

    Affected: from 4.2.0.Final, fixed in 4.2.17.Final; fixed in 4.1.137.Final.

    Fixed in 4.1.137.Final (released Aug 6, 2026, 11 days before disclosure) and 4.2.17.Final (released Aug 4, 2026, 13 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2026-59898Medium 6.3

    Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation

    Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final.

    Fixed in 4.1.136.Final (released Jul 8, 2026, 21 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 22 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2026-59899Medium 6.9

    Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

    Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final.

    Fixed in 4.1.136.Final (released Jul 8, 2026, 21 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 22 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2026-59921Medium 5.7

    Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

    Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final.

    Fixed in 4.1.136.Final (released Jul 8, 2026, 20 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 21 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2026-56746Medium 6.5

    Netty has a Security Control Bypass via CORS Short-Circuit Failure

    Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final.

    Fixed in 4.1.136.Final (released Jul 8, 2026, 13 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 14 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

    Affected: from 4.2.0.Final, fixed in 4.2.16.Final; from 4.1.0.Final, fixed in 4.1.136.Final.

    Fixed in 4.1.136.Final (released Jul 8, 2026, 13 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 14 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation

    Affected: from 4.2.0.Final, fixed in 4.2.16.Final; from 4.1.0.Final, fixed in 4.1.136.Final.

    Fixed in 4.1.136.Final (released Jul 8, 2026, 12 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 13 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty SPDY SETTINGS frame count materializes unbounded settings map

    Affected: from 4.2.0.Final, fixed in 4.2.16.Final; from 4.1.0.Final, fixed in 4.1.136.Final.

    Fixed in 4.1.136.Final (released Jul 8, 2026, 12 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 13 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2026-50020Medium 5.3

    Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

    Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.

    Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

    Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final.

    Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2026-42585Medium 6.5

    Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

    Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final.

    Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty: HttpClientCodec response desynchronization

    Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final.

    Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2026-42580Medium 6.5

    Netty: HTTP Request Smuggling due to incorrect chunk size parsing

    Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final.

    Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2026-42581Medium 5.8

    Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

    Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final.

    Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2026-41417Medium 5.3

    Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

    Affected: fixed in 4.1.133.Final; from 4.2.0.Alpha1, fixed in 4.2.13.Final.

    Fixed in 4.1.133.Final (released May 5, 2026, 1 day before disclosure) and 4.2.13.Final (released May 4, 2026, 2 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

Show all 24 advisoriesShow fewer advisories

  • Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

    Affected: fixed in 4.1.132.Final; from 4.2.0.Alpha1, fixed in 4.2.10.Final.

    Fixed in 4.1.132.Final (released Mar 24, 2026, 3 days before disclosure) and 4.2.10.Final (released Feb 5, 2026, 50 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2025-67735Medium 6.5

    Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

    Affected: from 4.2.0.Alpha1, fixed in 4.2.8.Final; fixed in 4.1.129.Final.

    Fixed in 4.1.129.Final (released Dec 11, 2025, 5 days before disclosure) and 4.2.8.Final (released Dec 11, 2025, 5 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

    Affected: fixed in 4.1.125.Final; from 4.2.0.Alpha1, fixed in 4.2.5.Final.

    Fixed in 4.1.125.Final (released Sep 3, 2025, the day of disclosure) and 4.2.5.Final (released Sep 3, 2025, the day of disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2024-29025Medium 5.3

    Netty HttpPostRequestDecoder can OOM

    Affected: fixed in 4.1.108.Final.

    Fixed in 4.1.108.Final (released Mar 21, 2024, 4 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2022-41915Medium 6.5

    Netty project is an event-driven asynchronous network application framework.

    Affected: from 4.1.83.Final, fixed in 4.1.86.Final.

    Fixed in 4.1.86.Final (released Dec 12, 2022, 1 day before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2022-24823Medium 5.5

    Local Information Disclosure Vulnerability in io.netty:netty-codec-http

    Affected: fixed in 4.1.77.Final.

    Fixed in 4.1.77.Final (released May 6, 2022, the day of disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2021-43797Medium 6.5

    HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

    Affected: from 4.0.0, fixed in 4.1.71.Final.

    Fixed in 4.1.71.Final (released Dec 9, 2021, the day of disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • CVE-2021-21290Medium 6.2

    Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

    Affected: from 4.0.0, fixed in 4.1.59.Final.

    Fixed in 4.1.59.Final (released Feb 8, 2021, the day of disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with

    Affected: fixed in 4.1.44.

    Fixed in 4.1.44.Final (released Dec 18, 2019, 42 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.