netty netty

• CVE-2026-100666 High 7.3 Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec 0.3%
• CVE-2026-100665 High 7.5 Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass 0.4%
• CVE-2026-100664 High 7.5 Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion 0.3%
• CVE-2026-100663 High 7.5 Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3 0.3%
• CVE-2026-100662 High 7.5 Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS 0.4%
• CVE-2026-100661 High 7.5 Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation 0.3%
• CVE-2026-100660 High 7.5 Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention 0.5%
• CVE-2026-100659 Medium 6.5 Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass 0.2%
• CVE-2026-89044 Medium 6.5 Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding 0.3%
• CVE-2026-76816 Low 3.5 Netty: MQTT Topic Name and Client ID Validation Bypass 0.2%
• CVE-2026-62380 Medium 6.3 Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection 0.3%
• CVE-2026-62243 High 7.5 Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass 0.2%
• CVE-2026-75595 Critical 9.1 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext 0.3%
• CVE-2026-75596 High 8.7 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing 0.4%
• CVE-2026-59903 Medium 6.5 Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite 0.3%
• CVE-2026-59902 High 7.5 Netty: Memory Exhaustion in SctpMessageCompletionHandler 0.4%
• CVE-2026-73508 Medium 5.3 Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names 0.6%
• CVE-2026-73507 High 7.5 Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion 0.8%
• CVE-2026-56818 Medium 6.5 Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state 0.5%
• CVE-2026-59898 Medium 6.3 Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation 0.4%
• CVE-2026-59899 Medium 6.9 Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service 0.6%
• CVE-2026-59900 Medium 6.9 Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass 0.4%
• CVE-2026-59901 High 8.7 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang 0.5%
• CVE-2026-59919 Medium 5.5 Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address 0.2%
• CVE-2026-59920 Medium 6.5 Netty: STOMP CONNECT Frame Header Injection 0.4%
• CVE-2026-56822 High 7.4 Netty: TOCTOU in OcspServerCertificateValidator 0.2%
• CVE-2026-56821 High 7.4 Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator 0.2%
• CVE-2026-59921 Medium 5.7 Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder 0.5%
• CVE-2026-56820 High 7.4 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks 0.3%
• CVE-2026-56819 High 7.5 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) 0.7%
• CVE-2026-56817 High 8.3 Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled 0.7%
• CVE-2026-56816 High 7.5 Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types 0.6%
• CVE-2026-56746 Medium 6.5 Netty has a Security Control Bypass via CORS Short-Circuit Failure 0.4%
• CVE-2026-56745 High 8.7 Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion 0.6%
• CVE-2026-55851 High 8.7 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion 0.6%
• CVE-2026-55833 High 7.5 Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation 0.7%
• CVE-2026-55831 High 7.5 Netty SPDY SETTINGS frame count materializes unbounded settings map 0.7%
• CVE-2026-44891 High 7.5 Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder 0.7%
• CVE-2026-50560 Medium 6.9 Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature 0.4%
• CVE-2026-50020 Medium 5.3 Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted 0.2%
• CVE-2026-50011 High 7.5 Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length 0.5%
• CVE-2026-50010 High 7.5 Netty's wrapping plain trust manager silently disables hostname verification 0.5%
• CVE-2026-50009 Medium 4.8 Netty QUIC stateless reset token material exposed through header-visible connection IDs 0.2%
• CVE-2026-48748 High 7.5 Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion 0.4%
• CVE-2026-48059 High 7.5 Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion 0.6%
• CVE-2026-48043 Medium 5.3 netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion 0.8%
• CVE-2026-48006 High 7.5 Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator 0.7%
• CVE-2026-47691 High 8.7 Netty has Insufficient Bailiwick Validation for NS Records 0.4%
• CVE-2026-47244 Medium 5.3 Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced 0.4%
• CVE-2026-46340 High 7.5 Netty: SCTP reassembly nests buffers without bound 0.6%