Log in Start free

netty

Products

ProductCVEsExploitedLatest
netty91–Sep 26, 2026
netty-incubator-codec-ohttp6–Sep 15, 2026
netty-tcnative4–Oct 26, 2026
netty-tcnative-boringssl-static3–Oct 26, 2026
io.netty:netty-codec-http21–Mar 9, 2021
netty-incubator-codec-quic1–Mar 31, 2025

Exploited and recent CVEs

  • CVE-2026-116542 Medium 5.3 Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding 0.2%
  • CVE-2026-116542 Medium 5.3 Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding 0.2%
  • CVE-2026-116541 Medium 5.9 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount 0.5%
  • CVE-2026-116541 Medium 5.9 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount 0.5%
  • CVE-2026-116540 Medium 5.9 netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback 0.5%
  • CVE-2026-116539 Medium 5.9 Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO 0.4%
  • CVE-2026-116539 Medium 5.9 Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO 0.4%
  • CVE-2026-100666 High 7.3 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec 0.3%
  • CVE-2026-100665 High 7.5 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass 0.4%
  • CVE-2026-100664 High 7.5 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion 0.3%
  • CVE-2026-100663 High 7.5 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3 0.3%
  • CVE-2026-100662 High 7.5 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS 0.4%
  • CVE-2026-100661 High 7.5 Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation 0.3%
  • CVE-2026-100660 High 7.5 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention 0.5%
  • CVE-2026-100659 Medium 6.5 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass 0.2%
  • CVE-2026-54251 High 8.7 netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service 0.5%
  • CVE-2026-89044 Medium 6.5 Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding 0.3%
  • CVE-2026-76816 Low 3.5 Netty: MQTT Topic Name and Client ID Validation Bypass 0.2%
  • CVE-2026-62380 Medium 6.3 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection 0.3%
  • CVE-2026-62243 High 7.5 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass 0.2%
  • CVE-2026-75595 Critical 9.1 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext 0.3%
  • CVE-2026-75596 High 8.7 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing 0.4%
  • CVE-2026-59903 Medium 6.5 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite 0.3%
  • CVE-2026-59902 High 7.5 Netty: Memory Exhaustion in SctpMessageCompletionHandler 0.4%
  • CVE-2026-73508 Medium 5.3 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names 0.6%
  • CVE-2026-73507 High 7.5 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion 0.8%
  • CVE-2026-56818 Medium 6.5 Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state 0.5%
  • CVE-2026-59898 Medium 6.3 Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation 0.4%
  • CVE-2026-59899 Medium 6.9 Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service 0.6%
  • CVE-2026-59900 Medium 6.9 Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass 0.4%