Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

Netty: Lz4FrameDecoder resource exhaustion

Netty: HTTP/3 QPACK literal unbounded allocation

Netty: epoll transport denial of service via RST on half-closed TCP connection

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients

Netty is an asynchronous, event-driven network application framework

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final

Netty project is an event-driven asynchronous network application framework

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression)

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length…

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to…

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop)

Netty: TOCTOU in OcspServerCertificateValidator

Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

Netty: CRLF Injection in Netty Redis Codec Encoder

Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port

Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state

Netty: STOMP CONNECT Frame Header Injection

Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

Netty has a Security Control Bypass via CORS Short-Circuit Failure

Netty: HTTP Request Smuggling due to incorrect chunk size parsing

Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients

Netty project is an event-driven asynchronous network application framework

HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling

Possible request smuggling in HTTP/2 due missing validation of content-length

Possible request smuggling in HTTP/2 due missing validation

Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address

Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery

Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients

Netty is an open-source, asynchronous event-driven network application framework

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass

Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature

Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced

Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients

Netty QUIC stateless reset token material exposed through header-visible connection IDs