Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 118

Export CSV
CVE-2026-116539

Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty-tcnative Netty-tcnative-boringssl-static
CVE-2026-116542

Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty-tcnative Netty-tcnative-boringssl-static
CVE-2026-116541

netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty-tcnative Netty-tcnative-boringssl-static
CVE-2026-116540

netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty-tcnative
CVE-2021-43797

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Oncommand Workflow Automation Snapcenter and 25 more
CVE-2021-37137

netty-codec: SnappyFrameDecoder doesn't restrict chunk length and may buffer skippable chunks in an unnecessary way

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Oncommand Insight Netty and 21 more
CVE-2021-37136

netty-codec: Bzip2Decoder doesn't allow setting size restrictions for decompressed data

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

CVSS 3.1 · 7.5 High EPSS 5.9% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Oncommand Insight Netty and 28 more
CVE-2021-21409

Possible request smuggling in HTTP/2 due missing validation of content-length

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final.

CVSS 3.1 · 5.9 Medium EPSS 4.9% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Oncommand Api Services Oncommand Workflow Automation and 26 more
CVE-2021-21295

Possible request smuggling in HTTP/2 due missing validation

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP/1.1. If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects, and these HTTP/1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.

CVSS 3.1 · 5.9 Medium EPSS 18.9% KEV · Not listed
Vendors
Apache Debian Netapp and 4 more
Products
Kudu Zookeeper Debian Linux and 16 more
CVE-2021-21290

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

CVSS 3.1 · 6.2 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Active Iq Unified Manager Cloud Secure Agent and 24 more
CVE-2019-20445

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVSS 3.1 · 9.1 Critical EPSS 13.8% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Spark Ubuntu Linux Debian Linux and 17 more
CVE-2019-20444

netty: HTTP request smuggling

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

CVSS 3.1 · 9.1 Critical EPSS 8.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 16 more
CVE-2019-16869

netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

CVSS 3.1 · 7.5 High EPSS 8.6% KEV · Not listed
Vendors
Canonical Debian Netty and 1 more
Products
Ubuntu Linux Debian Linux Netty and 11 more
CVE-2026-100661

Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A remote, unauthenticated peer can open a QPACK unidirectional stream (type 0x02 encoder or 0x03 decoder) and send a first byte with all prefix bits set (e.g. 0xFF for a 7-bit prefix or 0x3F for a 5-bit prefix) followed by an endless run of 0x80 continuation bytes. The decoder returns -1 ('need more bytes'), so callers never consume the input, the ByteToMessageDecoder cumulator grows without bound, and each decode() invocation re-scans the whole accumulated buffer, yielding O(N^2) CPU cost. The result is unbounded per-connection heap growth (OutOfMemoryError) and event-loop CPU starvation, reachable in every configuration. Fixed in 4.2.18.Final.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty
CVE-2026-100665

Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust managers, preventing endpoint identification from running even when HTTPS verification is configured. Attackers on the network path can present a certificate chain for the wrong hostname that the plain trust manager accepts, bypassing hostname authentication for QUIC clients.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty
CVE-2026-100666

Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational responses. If a client pipelines an HTTP/1.1 GET carrying an Expect: 100-continue header followed by a HEAD request, the 100 Continue response consumes the queued GET method, so the subsequent 200 OK for the GET is paired with HEAD and its body is dropped, while the following 200 OK for the HEAD request is written with a body. This desynchronizes HTTP parsing on the connection: the GET entity is never delivered and the HEAD response body is interpreted as the GET body, resulting in response splitting and unsafe connection reuse. Fixed in 4.2.17.Final and 4.1.137.Final.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty
CVE-2026-100662

Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK encoder stream, type 0x02). The handler accepts an attacker-declared string-literal length of up to Integer.MAX_VALUE (~2 GiB) for the Name Length and Value Length fields of the "Insert With Literal Name" instruction (RFC 9204 §4.3.3), with no per-instruction or per-literal length cap and no cumulation-size limit; the existing HTTP/3 limits (maxHeaderListSize, maxUnknownFramePayloadLength, DEFAULT_MAX_FIELD_SECTION_SIZE) are not applied to this handler. A remote, unauthenticated peer with an established HTTP/3 connection to a default Netty HTTP/3 server can declare a very large literal length and then trickle fewer bytes than declared, causing the ByteToMessageDecoder MERGE cumulator to retain and grow the per-connection buffer, and ultimately triggering a large byte-array allocation. This leads to unbounded per-connection heap growth and OutOfMemoryError, resulting in denial of service. Fixed in 4.2.18.Final.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Netty
Products
Netty
CVE-2026-100658

io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue in WebSocketServerExtensionHandler

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Netty
Products
Netty
CVE-2026-100657

io.netty/netty-codec-stomp: netty-codec-stomp: Denial of Service via memory leak during frame decoding

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Netty
Products
Netty
CVE-2026-100656

io.netty/netty-codec-http: Netty: Denial of Service via unbounded queue growth during HTTP request pipelining

This CVE ID has been rejected as a duplicate.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Netty
Products
Netty