Skip to content
OpenAdvisories

Product · io.netty

netty-codec-compression

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-42583

    Netty: Lz4FrameDecoder resource exhaustion

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus comp…

    netty io.netty netty netty-codec-compression Debian Wolfi Maven