Skip to content
OpenAdvisories

Package · Maven

io.netty:netty

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 6.5
    CVE-2021-43797

    HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

    Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the …

    netty netty netty netty Debian Ubuntu Maven
  • Medium 5.9
    CVE-2021-21409

    Possible request smuggling in HTTP/2 due missing validation of content-length

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that…

    netty netty netty netty Debian Ubuntu Maven
  • Medium 5.9
    CVE-2021-21295 EPSS 19%

    Possible request smuggling in HTTP/2 due missing validation

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that…

    netty io.netty:netty-codec-http2 netty netty Debian Ubuntu Maven
  • Medium 6.2
    CVE-2021-21290

    Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

    Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an…

    netty netty netty netty Debian Ubuntu Maven
  • Medium —
    CVE-2019-20445 EPSS 14%

    HTTP Request Smuggling in Netty

    HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

    druid netty netty io.netty:netty-handler Debian Ubuntu Wolfi Maven
  • Medium —
    CVE-2014-0193

    Netty denial of service vulnerability

    WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stre…

    io.netty:netty io.netty:netty-all Maven