MavenPackage

io.netty:netty-codec-http2

10 known vulnerabilities (4 high, 6 medium), with the versions each affects and the releases that fix them.

Latest release: 4.2.20.Final (Nov 2, 2026): no advisory affects it
Newest unaffected release: 4.2.20.Final (Nov 2, 2026), the latest release
Advisories: 10 · 4 high, 6 medium

Dependents: 4
Releases: 185 since 4.1.0.Final (May 25, 2016)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-59900
Affects 4.1.0.Beta4 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
CVE-2026-56819
Affects 4.1.0.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it)
CVE-2026-50560
Affects 4.1.0.Beta4 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Final to 4.2.14.Final (4.2.15.Final is outside it)
CVE-2026-48043
Affects 4.1.0.Beta4 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Alpha1 to 4.2.14.Final (4.2.15.Final is outside it)
CVE-2026-47244
Affects 4.1.0.Beta4 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Final to 4.2.14.Final (4.2.15.Final is outside it)
CVE-2026-42587
Affects 4.1.0.Beta4 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it)
CVE-2026-33871
Affects 4.1.0.Beta4 to 4.1.131.Final (4.1.132.Final is outside it); 4.2.0.Alpha1 to 4.2.10.Final (4.2.11.Final is outside it)
CVE-2025-55163
Affects 4.1.0.Beta4 to 4.1.123.Final (4.1.124.Final is outside it); 4.2.0.Alpha1 to 4.2.3.Final (4.2.4.Final is outside it)
CVE-2021-21409
Affects 4.1.0.Beta4 to 4.1.60.Final (4.1.61.Final is outside it)
CVE-2021-21295
Affects 4.1.0.Beta4 to 4.1.59.Final (4.1.60.Final is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 10

CVE-2026-59900Medium 6.9
Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final.
Fixed in 4.1.136.Final (released Jul 8, 2026, 21 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 22 days before disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2026-56819High 7.5
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Affected: from 4.2.0, fixed in 4.2.16.Final; from 4.1.0.Final, fixed in 4.1.136.Final.
Fixed in 4.1.136.Final (released Jul 8, 2026, 13 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 14 days before disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2026-50560Medium 6.9
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.
Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2026-48043Medium 5.3
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
Affected: fixed in 4.1.135.Final; from 4.2.0.Alpha1, fixed in 4.2.15.Final.
Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2026-47244Medium 5.3
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.
Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2026-42587High 7.5
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final.
Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2026-33871High 8.7
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
Affected: fixed in 4.1.132.Final; from 4.2.0.Alpha1, fixed in 4.2.11.Final.
Fixed in 4.1.132.Final (released Mar 24, 2026, 3 days before disclosure) and 4.2.11.Final (released Mar 24, 2026, 3 days before disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2025-55163High 8.2
Netty MadeYouReset HTTP/2 DDoS Vulnerability
Affected: from 4.2.0.Alpha1, fixed in 4.2.4.Final; fixed in 4.1.124.Final.
Fixed in 4.1.124.Final (released Aug 13, 2025, the day of disclosure) and 4.2.4.Final (released Aug 13, 2025, the day of disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2021-21409Medium 5.9
Possible request smuggling in HTTP/2 due missing validation of content-length
Affected: from 4.0.0, fixed in 4.1.61.Final.
Fixed in 4.1.61.Final (released Mar 30, 2021, the day of disclosure).
The latest release, 4.2.20.Final, is not affected.
CVE-2021-21295Medium 5.9
Possible request smuggling in HTTP/2 due missing validation
Affected: from 4.0.0, fixed in 4.1.60.Final.
Fixed in 4.1.60.Final (released Mar 9, 2021, the day of disclosure).
The latest release, 4.2.20.Final, is not affected.