# io.netty:netty-handler (Maven) vulnerabilities 12 known vulnerabilities (1 critical, 5 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.20.Final (Nov 2, 2026): no advisory affects it - Newest unaffected release: 4.2.20.Final (Nov 2, 2026), the latest release - Dependents: 30 - Releases: 267 since 4.0.0.Final (Jul 15, 2013) - Registry: https://central.sonatype.com/artifact/io.netty/netty-handler - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-75595: 4.0.0.Alpha1 to 4.1.136.Final (4.1.137.Final is outside it); 4.2.0.Final to 4.2.16.Final (4.2.17.Final is outside it) - CVE-2026-75596: 4.0.0.Alpha1 to 4.1.136.Final (4.1.137.Final is outside it); 4.2.0.Final to 4.2.16.Final (4.2.17.Final is outside it) - CVE-2026-50010: 4.0.0.Alpha1 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Final to 4.2.14.Final (4.2.15.Final is outside it) - CVE-2026-45416: 4.0.0.Alpha1 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Final to 4.2.14.Final (4.2.15.Final is outside it) - CVE-2026-44249: 4.0.0.Alpha1 to 4.1.134.Final (4.1.135.Final is outside it); 4.2.0.Final to 4.2.14.Final (4.2.15.Final is outside it) - CVE-2025-24970: 4.1.91.Final to 4.1.117.Final (4.1.118.Final is outside it) - CVE-2023-34462: 4.0.0.Alpha1 to 4.1.93.Final (4.1.94.Final is outside it) - CVE-2020-11612: 4.1.0.Final to 4.1.45.Final (4.1.46.Final is outside it) - CVE-2019-20445: 4.0.0.Final to 4.1.44.Final (4.1.45.Final is outside it) - CVE-2020-7238: 4.1.43.Final to 4.1.44.Final (4.1.45.Final is outside it) - CVE-2016-4970: 4.0.0.Alpha1 to 4.0.36.Final (4.0.37.Final is outside it); 4.1.0.Beta1 to 4.1.0.Final (4.1.1.Final is outside it) - CVE-2014-3488: no published release is affected ## Advisories (12) ### [CVE-2026-75595](https://cve.now/CVE-2026-75595): Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext - Severity: Critical 9.1 - Published: Aug 19, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.17.Final; fixed in 4.1.137.Final. - Fixed in 4.1.137.Final (released Aug 6, 2026, 13 days before disclosure) and 4.2.17.Final (released Aug 4, 2026, 15 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-75596](https://cve.now/CVE-2026-75596): Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing - Severity: High 8.7 - Published: Aug 19, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.17.Final; fixed in 4.1.137.Final. - Fixed in 4.1.137.Final (released Aug 6, 2026, 13 days before disclosure) and 4.2.17.Final (released Aug 4, 2026, 15 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-50010](https://cve.now/CVE-2026-50010): Netty's wrapping plain trust manager silently disables hostname verification - Severity: High 7.5 - Published: Jun 12, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final. - Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-45416](https://cve.now/CVE-2026-45416): Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes - Severity: High 7.5 - Published: Jun 12, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final. - Fixed in 4.1.135.Final (released Jun 2, 2026, 10 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 10 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2026-44249](https://cve.now/CVE-2026-44249): Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking - Severity: High 8.1 - Published: Jun 11, 2026 - Affected: from 4.2.0.Final, fixed in 4.2.15.Final; fixed in 4.1.135.Final. - Fixed in 4.1.135.Final (released Jun 2, 2026, 9 days before disclosure) and 4.2.15.Final (released Jun 2, 2026, 9 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2025-24970](https://cve.now/CVE-2025-24970): SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine - Severity: High 7.5 - Published: Feb 10, 2025 - Affected: from 4.1.91.Final, fixed in 4.1.118.Final. - Fixed in 4.1.118.Final (released Feb 10, 2025, the day of disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2023-34462](https://cve.now/CVE-2023-34462): netty-handler SniHandler 16MB allocation - Severity: Medium 6.5 - Published: Jun 22, 2023 - Affected: fixed in 4.1.94.Final. - Fixed in 4.1.94.Final (released Jun 20, 2023, 2 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2020-11612](https://cve.now/CVE-2020-11612): The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. - Severity: Unrated - Published: Apr 7, 2020 - Affected: from 4.1.0, fixed in 4.1.46. - Fixed in 4.1.46.Final (released Feb 28, 2020, 39 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2019-20445](https://cve.now/CVE-2019-20445): HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr - Severity: Unrated - Published: Jan 29, 2020 - Affected: from 4.0.0, fixed in 4.1.45. - Fixed in 4.1.45.Final (released Jan 13, 2020, 16 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2020-7238](https://cve.now/CVE-2020-7238): Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a… - Severity: Unrated - Published: Jan 27, 2020 - Affected: from 4.1.43, fixed in 4.1.45. - Fixed in 4.1.45.Final (released Jan 13, 2020, 14 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2016-4970](https://cve.now/CVE-2016-4970): handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial… - Severity: Unrated - Published: Apr 13, 2017 - Affected: from 4.0.0.Alpha1, fixed in 4.0.37.Final; from 4.1.0.Beta1, fixed in 4.1.1.Final. - Fixed in 4.0.37.Final (released Jun 7, 2016, 310 days before disclosure) and 4.1.1.Final (released Jun 7, 2016, 310 days before disclosure). - The latest release, 4.2.20.Final, is not affected. ### [CVE-2014-3488](https://cve.now/CVE-2014-3488): The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a… - Severity: Unrated - Published: Jul 31, 2014 - Affected: fixed in 3.9.2. - Fixed in 4.0.0.Final (released Jul 15, 2013, 381 days before disclosure, the advisory names 3.9.2, which was never published). - The latest release, 4.2.20.Final, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/io.netty:netty-handler Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.