- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 12 · 1 critical, 5 high, 1 medium
- Dependents
- 30
- Registry
- Maven Central
Advisories 12
- CVE-2026-75595Critical 9.1
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
Affected: from 4.2.0.Final, fixed in 4.2.17.Final; fixed in 4.1.137.Final.
- CVE-2026-75596High 8.7
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
Affected: from 4.2.0.Final, fixed in 4.2.17.Final; fixed in 4.1.137.Final.
- CVE-2026-50010High 7.5
Netty's wrapping plain trust manager silently disables hostname verification
Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.
- CVE-2026-45416High 7.5
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.
- CVE-2026-44249High 8.1
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final.
- CVE-2025-24970High 7.5
SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
Affected: from 4.1.91.Final, fixed in 4.1.118.Final.
- CVE-2023-34462Medium 6.5
netty-handler SniHandler 16MB allocation
Affected: fixed in 4.1.94.Final.
- CVE-2020-11612Unrated
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream.
Affected: from 4.1.0, fixed in 4.1.46.
- CVE-2019-20445Unrated
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr
Affected: from 4.0.0, fixed in 4.1.45.
- CVE-2020-7238Unrated
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a…
Affected: from 4.1.43, fixed in 4.1.45.
- CVE-2016-4970Unrated
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial…
Affected: from 4.0.0.Alpha1, fixed in 4.0.37.Final; from 4.1.0.Beta1, fixed in 4.1.1.Final.
- CVE-2014-3488Unrated
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a…
Affected: fixed in 3.9.2.