Skip to content
OpenAdvisories

Product · io.netty

netty-codec-http

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-42585

    Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Fi…

    netty io.netty netty netty-codec-http Debian Ubuntu Maven
  • Medium 6.5
    CVE-2026-42580

    Netty: HTTP Request Smuggling due to incorrect chunk size parsing

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

    netty io.netty netty netty-codec-http Debian Ubuntu Maven