# io.netty:netty-codec-http (Maven) vulnerabilities 24 known vulnerabilities (6 high, 16 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.20.Final (Nov 2, 2026): no advisory affects it - Newest unaffected release: 4.2.20.Final (Nov 2, 2026), the latest release - Dependents: 29 - Releases: 267 since 4.0.0.Final (Jul 15, 2013) - Registry: https://central.sonatype.com/artifact/io.netty/netty-codec-http - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-59903: 4.0.0.Alpha1 to 4.1.136.Final (4.1.137.Final is outside it); 4.2.0.Final to 4.2.16.Final (4.2.17.Final is outside it) - CVE-2026-59898: 4.0.0.Alpha1 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it) - CVE-2026-59899: 4.0.0.Alpha1 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it) - CVE-2026-59921: 4.0.0.Alpha1 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it) - CVE-2026-56746: 4.0.0.Alpha1 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it) - CVE-2026-56745: 4.1.0.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it) - CVE-2026-55833: 4.1.0.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it) - CVE-2026-55831: 4.1.0.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it) - CVE-2026-50020: 4.0.0.Alpha1 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Final to 4.2.14.Final (4.2.15.Final is outside it) - CVE-2026-42587: 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it) - CVE-2026-42585: 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it) - CVE-2026-42584: 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it) - CVE-2026-42580: 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it) - CVE-2026-42581: 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it) - CVE-2026-41417: 4.0.0.Alpha1 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it) - CVE-2026-33870: 4.0.0.Alpha1 to 4.1.131.Final (4.1.132.Final is outside it); 4.2.0.Alpha1 to 4.2.9.Final (4.2.10.Final is outside it) - CVE-2025-67735: 4.0.0.Alpha1 to 4.1.128.Final (4.1.129.Final is outside it); 4.2.0.Alpha1 to 4.2.7.Final (4.2.8.Final is outside it) - CVE-2025-58056: 4.0.0.Alpha1 to 4.1.124.Final (4.1.125.Final is outside it); 4.2.0.Alpha1 to 4.2.4.Final (4.2.5.Final is outside it) - CVE-2024-29025: 4.0.0.Alpha1 to 4.1.107.Final (4.1.108.Final is outside it) - CVE-2022-41915: 4.1.83.Final to 4.1.85.Final (4.1.86.Final is outside it) - CVE-2022-24823: 4.0.0.Alpha1 to 4.1.76.Final (4.1.77.Final is outside it) - CVE-2021-43797: 4.0.0.Final to 4.1.70.Final (4.1.71.Final is outside it) - CVE-2021-21290: 4.0.0.Final to 4.1.58.Final (4.1.59.Final is outside it) - CVE-2019-20444: 4.0.0.Alpha1 to 4.1.43.Final (4.1.44.Final is outside it) ## Advisories (24) ### [CVE-2026-59903](https://cve.now/CVE-2026-59903): Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite - Severity: Medium 6.5 - Published: Aug 17, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.17.Final; fixed in 4.1.137.Final. - Fixed in 4.1.137.Final (released Aug 6, 2026, 11 days before disclosure) and 4.2.17.Final (released Aug 4, 2026, 13 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-59898](https://cve.now/CVE-2026-59898): Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation - Severity: Medium 6.3 - Published: Jul 29, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final. - Fixed in 4.1.136.Final (released Jul 8, 2026, 21 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 22 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-59899](https://cve.now/CVE-2026-59899): Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service - Severity: Medium 6.9 - Published: Jul 29, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final. - Fixed in 4.1.136.Final (released Jul 8, 2026, 21 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 22 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-59921](https://cve.now/CVE-2026-59921): Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder - Severity: Medium 5.7 - Published: Jul 28, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final. - Fixed in 4.1.136.Final (released Jul 8, 2026, 20 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 21 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-56746](https://cve.now/CVE-2026-56746): Netty has a Security Control Bypass via CORS Short-Circuit Failure - Severity: Medium 6.5 - Published: Jul 21, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final. - Fixed in 4.1.136.Final (released Jul 8, 2026, 13 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 14 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-56745](https://cve.now/CVE-2026-56745): Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST\_STREAM Leads to Native Memory Exhaustion - Severity: High 8.7 - Published: Jul 21, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.16.Final; from 4.1.0.Final, fixed in 4.1.136.Final. - Fixed in 4.1.136.Final (released Jul 8, 2026, 13 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 14 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-55833](https://cve.now/CVE-2026-55833): Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation - Severity: High 7.5 - Published: Jul 20, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.16.Final; from 4.1.0.Final, fixed in 4.1.136.Final. - Fixed in 4.1.136.Final (released Jul 8, 2026, 12 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 13 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-55831](https://cve.now/CVE-2026-55831): Netty SPDY SETTINGS frame count materializes unbounded settings map - Severity: High 7.5 - Published: Jul 20, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.16.Final; from 4.1.0.Final, fixed in 4.1.136.Final. - Fixed in 4.1.136.Final (released Jul 8, 2026, 12 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 13 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-50020](https://cve.now/CVE-2026-50020): Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted - Severity: Medium 5.3 - Published: Jun 12, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final. - Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-42587](https://cve.now/CVE-2026-42587): Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS - Severity: High 7.5 - Published: May 13, 2026 - Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final. - Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-42585](https://cve.now/CVE-2026-42585): Netty: HTTP Request Smuggling due to malformed Transfer-Encoding - Severity: Medium 6.5 - Published: May 13, 2026 - Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final. - Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-42584](https://cve.now/CVE-2026-42584): Netty: HttpClientCodec response desynchronization - Severity: High 7.3 - Published: May 13, 2026 - Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final. - Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-42580](https://cve.now/CVE-2026-42580): Netty: HTTP Request Smuggling due to incorrect chunk size parsing - Severity: Medium 6.5 - Published: May 13, 2026 - Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final. - Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-42581](https://cve.now/CVE-2026-42581): Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization - Severity: Medium 5.8 - Published: May 13, 2026 - Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final. - Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-41417](https://cve.now/CVE-2026-41417): Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri() - Severity: Medium 5.3 - Published: May 6, 2026 - Affected: fixed in 4.1.133.Final; from 4.2.0.Alpha1, fixed in 4.2.13.Final. - Fixed in 4.1.133.Final (released May 5, 2026, 1 day before disclosure) and 4.2.13.Final (released May 4, 2026, 2 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-33870](https://cve.now/CVE-2026-33870): Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing - Severity: High 7.5 - Published: Mar 27, 2026 - Affected: fixed in 4.1.132.Final; from 4.2.0.Alpha1, fixed in 4.2.10.Final. - Fixed in 4.1.132.Final (released Mar 24, 2026, 3 days before disclosure) and 4.2.10.Final (released Feb 5, 2026, 50 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2025-67735](https://cve.now/CVE-2025-67735): Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder - Severity: Medium 6.5 - Published: Dec 16, 2025 - Affected: from 4.2.0.Alpha1, fixed in 4.2.8.Final; fixed in 4.1.129.Final. - Fixed in 4.1.129.Final (released Dec 11, 2025, 5 days before disclosure) and 4.2.8.Final (released Dec 11, 2025, 5 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2025-58056](https://cve.now/CVE-2025-58056): Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions - Severity: Low 2.9 - Published: Sep 3, 2025 - Affected: fixed in 4.1.125.Final; from 4.2.0.Alpha1, fixed in 4.2.5.Final. - Fixed in 4.1.125.Final (released Sep 3, 2025, the day of disclosure) and 4.2.5.Final (released Sep 3, 2025, the day of disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2024-29025](https://cve.now/CVE-2024-29025): Netty HttpPostRequestDecoder can OOM - Severity: Medium 5.3 - Published: Mar 25, 2024 - Affected: fixed in 4.1.108.Final. - Fixed in 4.1.108.Final (released Mar 21, 2024, 4 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2022-41915](https://cve.now/CVE-2022-41915): Netty project is an event-driven asynchronous network application framework. - Severity: Medium 6.5 - Published: Dec 13, 2022 - Affected: from 4.1.83.Final, fixed in 4.1.86.Final. - Fixed in 4.1.86.Final (released Dec 12, 2022, 1 day before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2022-24823](https://cve.now/CVE-2022-24823): Local Information Disclosure Vulnerability in io.netty:netty-codec-http - Severity: Medium 5.5 - Published: May 6, 2022 - Affected: fixed in 4.1.77.Final. - Fixed in 4.1.77.Final (released May 6, 2022, the day of disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2021-43797](https://cve.now/CVE-2021-43797): HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling - Severity: Medium 6.5 - Published: Dec 9, 2021 - Affected: from 4.0.0, fixed in 4.1.71.Final. - Fixed in 4.1.71.Final (released Dec 9, 2021, the day of disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2021-21290](https://cve.now/CVE-2021-21290): Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files - Severity: Medium 6.2 - Published: Feb 8, 2021 - Affected: from 4.0.0, fixed in 4.1.59.Final. - Fixed in 4.1.59.Final (released Feb 8, 2021, the day of disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2019-20444](https://cve.now/CVE-2019-20444): HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with - Severity: Unrated - Published: Jan 29, 2020 - Affected: fixed in 4.1.44. - Fixed in 4.1.44.Final (released Dec 18, 2019, 42 days before disclosure). - The latest release, 4.2.20.Final, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/io.netty:netty-codec-http Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.