Netty vulnerabilities
103 CVEs and advisories name Netty as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-116542Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding
- CVE-2026-116541netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount
- CVE-2026-116540netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback
- CVE-2026-116539Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO
- CVE-2026-100666Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
- CVE-2026-100665Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
- CVE-2026-100664Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion
- CVE-2026-100663Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3
- CVE-2026-100662Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
- CVE-2026-100661Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation
- CVE-2026-100660Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
- CVE-2026-100659Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass
- CVE-2026-54251netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
- CVE-2026-89044Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding
- CVE-2026-76816Netty: MQTT Topic Name and Client ID Validation Bypass
- CVE-2026-62380Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection
- CVE-2026-62243Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
- CVE-2026-75595Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
- CVE-2026-75596Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
- CVE-2026-59903Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
- CVE-2026-59902Netty: Memory Exhaustion in SctpMessageCompletionHandler
- CVE-2026-73508Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
- CVE-2026-73507Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
- CVE-2026-56818Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
- CVE-2026-59898Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
- CVE-2026-59899Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
- CVE-2026-59900Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
- CVE-2026-59901Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
- CVE-2026-59919Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
- CVE-2026-59920Netty: STOMP CONNECT Frame Header Injection