Skip to content
OpenAdvisories

Product · io.netty

netty-codec-http3

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-42582

    Netty: HTTP/3 QPACK literal unbounded allocation

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string…

    netty io.netty netty netty-codec-http3 Debian Wolfi Maven