Skip to content
OpenAdvisories

Vendor

io.netty

8 known vulnerabilities.

Products

netty-codec-http 4 netty-codec-http2 1 netty-codec-mqtt 1 netty-codec-http3 1 netty-codec-redis 1 netty-codec 1 netty-codec-compression 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-44248

    Netty: Resource exhaustion in MqttDecoder

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariab…

    netty io.netty netty netty-codec-mqtt Debian Wolfi Maven
  • Medium 6.8
    CVE-2026-42586

    Netty: CRLF Injection in Netty Redis Codec Encoder

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanit…

    netty io.netty netty netty-codec-redis Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2026-42585

    Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Fi…

    netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2026-42580

    Netty: HTTP Request Smuggling due to incorrect chunk size parsing

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

    netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven