Skip to content
OpenAdvisories

Vendor

netty

103 known vulnerabilities.

Products

netty 91 netty-incubator-codec-ohttp 6 netty-tcnative 4 netty-tcnative-boringssl-static 3 netty-incubator-codec-quic 1 io.netty:netty-codec-http2 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.5
    CVE-2026-76816

    Netty: MQTT Topic Name and Client ID Validation Bypass

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.137.Final and 4.2.17.Final, MqttEncoder does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null…

    netty netty netty netty Debian Ubuntu
  • Low 2.9
    CVE-2026-42578

    Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers…

    netty netty netty netty Debian Ubuntu Maven
  • Low 2.9
    CVE-2025-58056

    Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions

    Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline ch…

    netty netty netty netty Debian Ubuntu Maven