- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 10 · 4 medium
- Registry
- Maven Central
Advisories 10
- CVE-2021-43797Medium 6.5
HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling
Affected: all versions.
- CVE-2021-37137Unrated
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage.
Affected: all versions.
- CVE-2021-37136Unrated
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocati
Affected: all versions.
- CVE-2021-21409Medium 5.9
Possible request smuggling in HTTP/2 due missing validation of content-length
Affected: all versions.
- CVE-2021-21295Medium 5.9
Possible request smuggling in HTTP/2 due missing validation
Affected: all versions.
- CVE-2021-21290Medium 6.2
Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files
Affected: all versions.
- CVE-2019-20444Unrated
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with
Affected: all versions.
- CVE-2019-20445Unrated
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Tr
Affected: all versions.
- CVE-2019-16869Unrated
Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads
Affected: through 3.2.9.Final.
- CVE-2015-2156Unrated
Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x…
Affected: fixed in 3.9.8.Final; from 3.10.0, fixed in 3.10.3.Final.