Skip to content
OpenAdvisories

Package · Maven

io.netty:netty-codec-http2

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-56819 Public exploit

    Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

    Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame i…

    netty netty druid trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-33871 Public exploit

    Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

    Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The serve…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 8.2
    CVE-2025-55163 Public exploit

    Netty MadeYouReset HTTP/2 DDoS Vulnerability

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven