Skip to content
OpenAdvisories

Package · Maven

io.netty:netty-codec-http2

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-59900

    Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.9
    CVE-2026-50560

    Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-48043

    netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion

    Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a p…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-47244

    Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

    Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings …

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.9
    CVE-2021-21409

    Possible request smuggling in HTTP/2 due missing validation of content-length

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 5.9
    CVE-2021-21295 EPSS 19%

    Possible request smuggling in HTTP/2 due missing validation

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that…

    netty io.netty:netty-codec-http2 netty netty Debian Ubuntu Maven