Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

io.netty:netty-codec-http3

4 known vulnerabilities (4 high), with the versions each affects and the releases that fix them.

Latest release
4.2.20.Final (Nov 2, 2026): no advisory affects it
Newest unaffected release
4.2.20.Final (Nov 2, 2026), the latest release
Advisories
4 · 4 high
Dependents
1,169
Releases
19 since 4.2.2.Final (Jun 5, 2025)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-56816
    Affects 4.2.2.Final to 4.2.15.Final (4.2.16.Final is outside it)
  • CVE-2026-48748
    Affects 4.2.2.Final to 4.2.14.Final (4.2.15.Final is outside it)
  • CVE-2026-44892
    Affects 4.2.2.Final to 4.2.14.Final (4.2.15.Final is outside it)
  • CVE-2026-42582
    Affects 4.2.2.Final to 4.2.12.Final (4.2.13.Final is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types

    Affected: fixed in 4.2.16.Final.

    Fixed in 4.2.16.Final (released Jul 7, 2026, 14 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion

    Affected: from 4.2.0.Final, fixed in 4.2.15.Final.

    Fixed in 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size

    Affected: from 4.2.0.Final, fixed in 4.2.15.Final.

    Fixed in 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.

  • Netty: HTTP/3 QPACK literal unbounded allocation

    Affected: from 4.2.0.Final, fixed in 4.2.13.Final.

    Fixed in 4.2.13.Final (released May 4, 2026, 9 days before disclosure).

    The latest release, 4.2.20.Final, is not affected.