# io.netty:netty (Maven) vulnerabilities

11 known vulnerabilities (4 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://central.sonatype.com/artifact/io.netty/netty

## Advisories (11)

### [CVE-2021-43797](https://cve.now/CVE-2021-43797): HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

- Severity: Medium 6.5
- Published: Dec 9, 2021
- Affected: all versions.

### [CVE-2021-37137](https://cve.now/CVE-2021-37137): The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.

- Severity: Unrated
- Published: Oct 19, 2021
- Affected: all versions.

### [CVE-2021-37136](https://cve.now/CVE-2021-37136): The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocati

- Severity: Unrated
- Published: Oct 19, 2021
- Affected: all versions.

### [CVE-2021-21409](https://cve.now/CVE-2021-21409): Possible request smuggling in HTTP/2 due missing validation of content-length

- Severity: Medium 5.9
- Published: Mar 30, 2021
- Affected: all versions.

### [CVE-2021-21295](https://cve.now/CVE-2021-21295): Possible request smuggling in HTTP/2 due missing validation

- Severity: Medium 5.9
- Published: Mar 9, 2021
- Affected: all versions.

### [CVE-2021-21290](https://cve.now/CVE-2021-21290): Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

- Severity: Medium 6.2
- Published: Feb 8, 2021
- Affected: all versions.

### [CVE-2019-20444](https://cve.now/CVE-2019-20444): HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with

- Severity: Unrated
- Published: Jan 29, 2020
- Affected: all versions.

### [CVE-2019-20445](https://cve.now/CVE-2019-20445): HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr

- Severity: Unrated
- Published: Jan 29, 2020
- Affected: all versions.

### [CVE-2019-16869](https://cve.now/CVE-2019-16869): Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads

- Severity: Unrated
- Published: Sep 26, 2019
- Affected: from 3.3.0.Final, through 4.0.0.Alpha8.

### [CVE-2015-2156](https://cve.now/CVE-2015-2156): Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x…

- Severity: Unrated
- Published: Oct 18, 2017
- Affected: from 3.10.0, fixed in 3.10.3.Final; fixed in 3.9.8.Final.

### [CVE-2014-0193](https://cve.now/CVE-2014-0193): WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19…

- Severity: Unrated
- Published: May 6, 2014
- Affected: from 3.6.0.Beta1, fixed in 3.6.9.Final; from 3.7.0.Final, fixed in 3.7.1.Final; from 3.8.0.Final, fixed in 3.8.2.Final; from 3.9.0.Final, fixed in 3.9.1.Final; from 4.0.0.Alpha1, fixed in 4.0.19.Final.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/io.netty:netty
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.