# io.netty:netty-codec-http2 (Maven) vulnerabilities 10 known vulnerabilities (4 high, 6 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.20.Final (Nov 2, 2026): no advisory affects it - Newest unaffected release: 4.2.20.Final (Nov 2, 2026), the latest release - Dependents: 4 - Releases: 185 since 4.1.0.Final (May 25, 2016) - Registry: https://central.sonatype.com/artifact/io.netty/netty-codec-http2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-59900: 4.1.0.Beta4 to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it) - CVE-2026-56819: 4.1.0.Final to 4.1.135.Final (4.1.136.Final is outside it); 4.2.0.Final to 4.2.15.Final (4.2.16.Final is outside it) - CVE-2026-50560: 4.1.0.Beta4 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Final to 4.2.14.Final (4.2.15.Final is outside it) - CVE-2026-48043: 4.1.0.Beta4 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Alpha1 to 4.2.14.Final (4.2.15.Final is outside it) - CVE-2026-47244: 4.1.0.Beta4 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Final to 4.2.14.Final (4.2.15.Final is outside it) - CVE-2026-42587: 4.1.0.Beta4 to 4.1.132.Final (4.1.133.Final is outside it); 4.2.0.Alpha1 to 4.2.12.Final (4.2.13.Final is outside it) - CVE-2026-33871: 4.1.0.Beta4 to 4.1.131.Final (4.1.132.Final is outside it); 4.2.0.Alpha1 to 4.2.10.Final (4.2.11.Final is outside it) - CVE-2025-55163: 4.1.0.Beta4 to 4.1.123.Final (4.1.124.Final is outside it); 4.2.0.Alpha1 to 4.2.3.Final (4.2.4.Final is outside it) - CVE-2021-21409: 4.1.0.Beta4 to 4.1.60.Final (4.1.61.Final is outside it) - CVE-2021-21295: 4.1.0.Beta4 to 4.1.59.Final (4.1.60.Final is outside it) ## Advisories (10) ### [CVE-2026-59900](https://cve.now/CVE-2026-59900): Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass - Severity: Medium 6.9 - Published: Jul 29, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.16.Final; fixed in 4.1.136.Final. - Fixed in 4.1.136.Final (released Jul 8, 2026, 21 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 22 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-56819](https://cve.now/CVE-2026-56819): Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) - Severity: High 7.5 - Published: Jul 21, 2026 - Affected: from 4.2.0, fixed in 4.2.16.Final; from 4.1.0.Final, fixed in 4.1.136.Final. - Fixed in 4.1.136.Final (released Jul 8, 2026, 13 days before disclosure) and 4.2.16.Final (released Jul 7, 2026, 14 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-50560](https://cve.now/CVE-2026-50560): Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature - Severity: Medium 6.9 - Published: Jun 12, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final. - Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-48043](https://cve.now/CVE-2026-48043): netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion - Severity: Medium 5.3 - Published: Jun 12, 2026 - Affected: fixed in 4.1.135.Final; from 4.2.0.Alpha1, fixed in 4.2.15.Final. - Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-47244](https://cve.now/CVE-2026-47244): Netty HTTP/2: Advertised MAX\_CONCURRENT\_STREAMS are not enforced - Severity: Medium 5.3 - Published: Jun 12, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final. - Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-42587](https://cve.now/CVE-2026-42587): Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS - Severity: High 7.5 - Published: May 13, 2026 - Affected: from 4.2.0.Alpha1, fixed in 4.2.13.Final; fixed in 4.1.133.Final. - Fixed in 4.1.133.Final (released May 5, 2026, 8 days before disclosure) and 4.2.13.Final (released May 4, 2026, 9 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-33871](https://cve.now/CVE-2026-33871): Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass - Severity: High 8.7 - Published: Mar 27, 2026 - Affected: fixed in 4.1.132.Final; from 4.2.0.Alpha1, fixed in 4.2.11.Final. - Fixed in 4.1.132.Final (released Mar 24, 2026, 3 days before disclosure) and 4.2.11.Final (released Mar 24, 2026, 3 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2025-55163](https://cve.now/CVE-2025-55163): Netty MadeYouReset HTTP/2 DDoS Vulnerability - Severity: High 8.2 - Published: Aug 13, 2025 - Affected: from 4.2.0.Alpha1, fixed in 4.2.4.Final; fixed in 4.1.124.Final. - Fixed in 4.1.124.Final (released Aug 13, 2025, the day of disclosure) and 4.2.4.Final (released Aug 13, 2025, the day of disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2021-21409](https://cve.now/CVE-2021-21409): Possible request smuggling in HTTP/2 due missing validation of content-length - Severity: Medium 5.9 - Published: Mar 30, 2021 - Affected: from 4.0.0, fixed in 4.1.61.Final. - Fixed in 4.1.61.Final (released Mar 30, 2021, the day of disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2021-21295](https://cve.now/CVE-2021-21295): Possible request smuggling in HTTP/2 due missing validation - Severity: Medium 5.9 - Published: Mar 9, 2021 - Affected: from 4.0.0, fixed in 4.1.60.Final. - Fixed in 4.1.60.Final (released Mar 9, 2021, the day of disclosure). - The latest release, 4.2.20.Final, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/io.netty:netty-codec-http2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.