Login Request a demo
NE
Product
netty
by netty · last CVE Sep 26, 2026
On CISA KEVExploited in the wild
103
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities103In the news0Timeline
Severity mix
Critical 10High 63Medium 27Low 1
Severity
All severities103Critical10High63Medium27Low1
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add netty to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-47691
10.0
0%
Jun 12
Netty has Insufficient Bailiwick Validation for NS Records
Affected: >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final
CVE-2026-45674
10.0
0%
Jun 12
Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records
Affected: >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final
CVE-2026-56817
9.8
1%
Jul 21
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
Affected: >= 4.2.0.Final, < 4.2.16.Final; >= 4.1.0.Final, < 4.1.136.Final
CVE-2026-42581
9.8
1%
May 13
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Affected: >= 4.2.0.Alpha1, < 4.2.13.Final; < 4.1.133.Final
CVE-2026-75595
9.1
0%
Aug 19
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
Affected: < 4.1.137.Final; >= 4.2.0.Final, < 4.2.17.Final
CVE-2026-56820
9.1
0%
Jul 21
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
Affected: >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final
CVE-2026-42584
9.1
1%
May 13
Netty: HttpClientCodec response desynchronization
Affected: >= 4.2.0.Alpha1, < 4.2.13.Final; < 4.1.133.Final
CVE-2026-42579
9.1
1%
May 13
Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
Affected: >= 4.2.0.Alpha1, < 4.2.13.Final; < 4.1.133.Final
CVE-2019-20444
9.1
9%
Jan 29
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be…
Affected: before 4.1.44
CVE-2019-20445
9.1
14%
Jan 29
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header
Affected: before 4.1.44
Showing 10