# cve.now: Netty

The newest entries naming Netty as an affected vendor (up to 200), of 103 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116542](https://cve.now/CVE-2026-116542.md): Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding (CVSS 6.9)
- [CVE-2026-116541](https://cve.now/CVE-2026-116541.md): netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount (CVSS 8.2)
- [CVE-2026-116540](https://cve.now/CVE-2026-116540.md): netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback (CVSS 8.2)
- [CVE-2026-116539](https://cve.now/CVE-2026-116539.md): Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO (CVSS 8.2)
- [CVE-2026-100666](https://cve.now/CVE-2026-100666.md): Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec (CVSS 6.9)
- [CVE-2026-100665](https://cve.now/CVE-2026-100665.md): Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass (CVSS 8.7)
- [CVE-2026-100664](https://cve.now/CVE-2026-100664.md): Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion (CVSS 8.7)
- [CVE-2026-100663](https://cve.now/CVE-2026-100663.md): Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3 (CVSS 8.7)
- [CVE-2026-100662](https://cve.now/CVE-2026-100662.md): Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS (CVSS 8.7)
- [CVE-2026-100661](https://cve.now/CVE-2026-100661.md): Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation (CVSS 8.7)
- [CVE-2026-100660](https://cve.now/CVE-2026-100660.md): Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention (CVSS 8.7)
- [CVE-2026-100659](https://cve.now/CVE-2026-100659.md): Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass (CVSS 6.9)
- [CVE-2026-54251](https://cve.now/CVE-2026-54251.md): netty-incubator-codec-ohttp: \[OHttpServerCodec\] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service (CVSS 8.7)
- [CVE-2026-89044](https://cve.now/CVE-2026-89044.md): Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding (CVSS 6.9)
- [CVE-2026-76816](https://cve.now/CVE-2026-76816.md): Netty: MQTT Topic Name and Client ID Validation Bypass (CVSS 3.5)
- [CVE-2026-62380](https://cve.now/CVE-2026-62380.md): Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection (CVSS 6.3)
- [CVE-2026-62243](https://cve.now/CVE-2026-62243.md): Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass (CVSS 8.7)
- [CVE-2026-75595](https://cve.now/CVE-2026-75595.md): Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext (CVSS 9.1)
- [CVE-2026-75596](https://cve.now/CVE-2026-75596.md): Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing (CVSS 8.7)
- [CVE-2026-59903](https://cve.now/CVE-2026-59903.md): Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite (CVSS 6.5)
- [CVE-2026-59902](https://cve.now/CVE-2026-59902.md): Netty: Memory Exhaustion in SctpMessageCompletionHandler (CVSS 7.5)
- [CVE-2026-73508](https://cve.now/CVE-2026-73508.md): Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names (CVSS 5.3)
- [CVE-2026-73507](https://cve.now/CVE-2026-73507.md): Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion (CVSS 7.5)
- [CVE-2026-56818](https://cve.now/CVE-2026-56818.md): Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state (CVSS 6.5)
- [CVE-2026-59898](https://cve.now/CVE-2026-59898.md): Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation (CVSS 6.3)
- [CVE-2026-59899](https://cve.now/CVE-2026-59899.md): Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service (CVSS 6.9)
- [CVE-2026-59900](https://cve.now/CVE-2026-59900.md): Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass (CVSS 6.9)
- [CVE-2026-59901](https://cve.now/CVE-2026-59901.md): Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang (CVSS 8.7)
- [CVE-2026-59919](https://cve.now/CVE-2026-59919.md): Netty: HAProxy V1 Protocol CRLF Injection via AF\_UNIX Address (CVSS 5.5)
- [CVE-2026-59920](https://cve.now/CVE-2026-59920.md): Netty: STOMP CONNECT Frame Header Injection (CVSS 6.5)
- [CVE-2026-56822](https://cve.now/CVE-2026-56822.md): Netty: TOCTOU in OcspServerCertificateValidator (CVSS 7.4)
- [CVE-2026-56821](https://cve.now/CVE-2026-56821.md): Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator (CVSS 7.4)
- [CVE-2026-59921](https://cve.now/CVE-2026-59921.md): Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder (CVSS 5.7)
- [CVE-2026-56820](https://cve.now/CVE-2026-56820.md): Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks (CVSS 7.4)
- [CVE-2026-56819](https://cve.now/CVE-2026-56819.md): Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) (CVSS 7.5)
- [CVE-2026-56817](https://cve.now/CVE-2026-56817.md): Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled (CVSS 8.3)
- [CVE-2026-56816](https://cve.now/CVE-2026-56816.md): Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types (CVSS 7.5)
- [CVE-2026-56746](https://cve.now/CVE-2026-56746.md): Netty has a Security Control Bypass via CORS Short-Circuit Failure (CVSS 6.5)
- [CVE-2026-56745](https://cve.now/CVE-2026-56745.md): Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST\_STREAM Leads to Native Memory Exhaustion (CVSS 8.7)
- [CVE-2026-55851](https://cve.now/CVE-2026-55851.md): Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion (CVSS 8.7)
- [CVE-2026-55833](https://cve.now/CVE-2026-55833.md): Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation (CVSS 7.5)
- [CVE-2026-55831](https://cve.now/CVE-2026-55831.md): Netty SPDY SETTINGS frame count materializes unbounded settings map (CVSS 7.5)
- [CVE-2026-44891](https://cve.now/CVE-2026-44891.md): Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder (CVSS 7.5)
- [CVE-2026-50560](https://cve.now/CVE-2026-50560.md): Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature (CVSS 6.9)
- [CVE-2026-50020](https://cve.now/CVE-2026-50020.md): Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted (CVSS 5.3)
- [CVE-2026-50011](https://cve.now/CVE-2026-50011.md): Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length (CVSS 7.5)
- [CVE-2026-50010](https://cve.now/CVE-2026-50010.md): Netty's wrapping plain trust manager silently disables hostname verification (CVSS 7.5)
- [CVE-2026-50009](https://cve.now/CVE-2026-50009.md): Netty QUIC stateless reset token material exposed through header-visible connection IDs (CVSS 4.8)
- [CVE-2026-48748](https://cve.now/CVE-2026-48748.md): Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion (CVSS 7.5)
- [CVE-2026-48059](https://cve.now/CVE-2026-48059.md): Netty HAProxy: Unbalanced Reference Count in Nested PP2\_TYPE\_SSL TLV Parsing Leads to Memory Exhaustion (CVSS 8.7)
- [CVE-2026-48043](https://cve.now/CVE-2026-48043.md): netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion (CVSS 5.3)
- [CVE-2026-48006](https://cve.now/CVE-2026-48006.md): Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator (CVSS 8.7)
- [CVE-2026-47691](https://cve.now/CVE-2026-47691.md): Netty has Insufficient Bailiwick Validation for NS Records (CVSS 8.7)
- [CVE-2026-47244](https://cve.now/CVE-2026-47244.md): Netty HTTP/2: Advertised MAX\_CONCURRENT\_STREAMS are not enforced (CVSS 5.3)
- [CVE-2026-46340](https://cve.now/CVE-2026-46340.md): Netty: SCTP reassembly nests buffers without bound (CVSS 7.5)
- [CVE-2026-45674](https://cve.now/CVE-2026-45674.md): Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records (CVSS 8.7)
- [CVE-2026-45673](https://cve.now/CVE-2026-45673.md): Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port (CVSS 6.8)
- [CVE-2026-45536](https://cve.now/CVE-2026-45536.md): Netty: Unix-socket fd receive leaks descriptors when peer sends two at once (CVSS 4.0)
- [CVE-2026-45416](https://cve.now/CVE-2026-45416.md): Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes (CVSS 7.5)
- [CVE-2026-44894](https://cve.now/CVE-2026-44894.md): Netty's Default QUIC token handler accepts any client-supplied token (CVSS 7.5)
- [CVE-2026-44893](https://cve.now/CVE-2026-44893.md): Netty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV length (CVSS 7.5)
- [CVE-2026-44892](https://cve.now/CVE-2026-44892.md): Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size (CVSS 7.5)
- [CVE-2026-44890](https://cve.now/CVE-2026-44890.md): Netty has Unbounded Direct Memory Consumption in its RedisDecoder (CVSS 7.5)
- [CVE-2026-44250](https://cve.now/CVE-2026-44250.md): Netty: Memory Exhaustion in RedisArrayAggregator due to Deeply Nested Arrays (CVSS 7.5)
- [CVE-2026-44249](https://cve.now/CVE-2026-44249.md): Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking (CVSS 8.1)
- [CVE-2026-48480](https://cve.now/CVE-2026-48480.md): netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation (CVSS 6.6)
- [CVE-2026-48040](https://cve.now/CVE-2026-48040.md): netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access (CVSS 6.8)
- [CVE-2026-41207](https://cve.now/CVE-2026-41207.md): netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte\[\] on failures (CVSS 6.9)
- [CVE-2026-44248](https://cve.now/CVE-2026-44248.md): Netty: Resource exhaustion in MqttDecoder (CVSS 5.3)
- [CVE-2026-42587](https://cve.now/CVE-2026-42587.md): Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS (CVSS 7.5)
- [CVE-2026-42586](https://cve.now/CVE-2026-42586.md): Netty: CRLF Injection in Netty Redis Codec Encoder (CVSS 6.8)
- [CVE-2026-42585](https://cve.now/CVE-2026-42585.md): Netty: HTTP Request Smuggling due to malformed Transfer-Encoding (CVSS 6.5)
- [CVE-2026-42584](https://cve.now/CVE-2026-42584.md): Netty: HttpClientCodec response desynchronization (CVSS 7.3)
- [CVE-2026-42583](https://cve.now/CVE-2026-42583.md): Netty: Lz4FrameDecoder resource exhaustion (CVSS 7.5)
- [CVE-2026-42582](https://cve.now/CVE-2026-42582.md): Netty: HTTP/3 QPACK literal unbounded allocation (CVSS 7.5)
- [CVE-2026-42580](https://cve.now/CVE-2026-42580.md): Netty: HTTP Request Smuggling due to incorrect chunk size parsing (CVSS 6.5)
- [CVE-2026-42579](https://cve.now/CVE-2026-42579.md): Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) (CVSS 7.5)
- [CVE-2026-42577](https://cve.now/CVE-2026-42577.md): Netty: epoll transport denial of service via RST on half-closed TCP connection (CVSS 7.5)
- [CVE-2026-42578](https://cve.now/CVE-2026-42578.md): Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVSS 2.9)
- [CVE-2026-42581](https://cve.now/CVE-2026-42581.md): Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization (CVSS 5.8)
- [CVE-2026-41417](https://cve.now/CVE-2026-41417.md): Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri() (CVSS 5.3)
- [CVE-2026-33871](https://cve.now/CVE-2026-33871.md): Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass (CVSS 8.7)
- [CVE-2026-33870](https://cve.now/CVE-2026-33870.md): Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (CVSS 7.5)
- [CVE-2025-67735](https://cve.now/CVE-2025-67735.md): Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder (CVSS 6.5)
- [CVE-2025-59419](https://cve.now/CVE-2025-59419.md): Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery (CVSS 5.5)
- [CVE-2025-58057](https://cve.now/CVE-2025-58057.md): Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack (CVSS 6.9)
- [CVE-2025-58056](https://cve.now/CVE-2025-58056.md): Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVSS 2.9)
- [CVE-2025-55163](https://cve.now/CVE-2025-55163.md): Netty MadeYouReset HTTP/2 DDoS Vulnerability (CVSS 8.2)
- [CVE-2025-29908](https://cve.now/CVE-2025-29908.md): Netty QUIC hash collision DoS attack (CVSS 5.3)
- [CVE-2025-25193](https://cve.now/CVE-2025-25193.md): Denial of Service attack on windows app using Netty (CVSS 5.5)
- [CVE-2025-24970](https://cve.now/CVE-2025-24970.md): SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine (CVSS 7.5)
- [CVE-2024-47535](https://cve.now/CVE-2024-47535.md): Denial of Service attack on windows app using Netty (CVSS 5.5)
- [CVE-2024-40642](https://cve.now/CVE-2024-40642.md): Absent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp (CVSS 8.1)
- [CVE-2024-36121](https://cve.now/CVE-2024-36121.md): netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces (CVSS 5.9)
- [CVE-2024-29025](https://cve.now/CVE-2024-29025.md): Netty HttpPostRequestDecoder can OOM (CVSS 5.3)
- [CVE-2023-34462](https://cve.now/CVE-2023-34462.md): netty-handler SniHandler 16MB allocation (CVSS 6.5)
- [CVE-2022-41915](https://cve.now/CVE-2022-41915.md): Netty project is an event-driven asynchronous network application framework. (CVSS 6.5)
- [CVE-2022-41881](https://cve.now/CVE-2022-41881.md): Netty project is an event-driven asynchronous network application framework. (CVSS 5.3)
- [CVE-2022-24823](https://cve.now/CVE-2022-24823.md): Local Information Disclosure Vulnerability in io.netty:netty-codec-http (CVSS 5.5)
- [CVE-2021-43797](https://cve.now/CVE-2021-43797.md): HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling (CVSS 6.5)
- [CVE-2021-21409](https://cve.now/CVE-2021-21409.md): Possible request smuggling in HTTP/2 due missing validation of content-length (CVSS 5.9)
- [CVE-2021-21295](https://cve.now/CVE-2021-21295.md): Possible request smuggling in HTTP/2 due missing validation (CVSS 5.9)
- [CVE-2021-21290](https://cve.now/CVE-2021-21290.md): Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files (CVSS 6.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/netty
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.