NE
Product
netty
On CISA KEVExploited in the wild
104
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 10High 63Medium 28Low 1
Watch
Add netty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-45673 | 6.8 | Jun 12 | Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port Affected: >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final |
| CVE-2026-100659 | 6.5 | Sep 26 | Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass Affected: 4.2.0.Final before 4.2.18.Final |
| CVE-2026-89044 | 6.5 | Sep 10 | Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding Affected: 4.1.133.Final before 4.1.138.Final; 4.2.13.Final before 4.2.18.Final |
| CVE-2026-56818 | 6.5 | Aug 7 | Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state Affected: < 4.1.136.Final; >= 4.2.0-Final, < 4.2.16.Final |
| CVE-2026-59920 | 6.5 | Jul 29 | Netty: STOMP CONNECT Frame Header Injection Affected: < 4.1.136.Final; >= 4.2.0.Final, < 4.2.16.Final |
| CVE-2026-59921 | 6.5 | Jul 28 | Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder Affected: >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final |
| CVE-2026-56746 | 6.5 | Jul 21 | Netty has a Security Control Bypass via CORS Short-Circuit Failure Affected: >= 4.2.0.Final, < 4.2.16.Final; >= 4.1.0.Final, < 4.1.136.Final |
| CVE-2026-42580 | 6.5 | May 13 | Netty: HTTP Request Smuggling due to incorrect chunk size parsing Affected: >= 4.2.0.Alpha1, < 4.2.13.Final; < 4.1.133.Final |
| CVE-2025-67735 | 6.5 | Dec 16 | Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder Affected: >= 4.2.0.Alpha1, < 4.2.8.Final; < 4.1.129.Final |
| CVE-2023-34462 | 6.5 | Jun 22 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients Affected: before 4.1.94 |
| CVE-2022-41915 | 6.5 | Dec 13 | Netty project is an event-driven asynchronous network application framework Affected: 4.1.83 before 4.1.86 |
| CVE-2021-43797 | 6.5 | Dec 9 | HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling Affected: <= 4.1.7.0.Final |
| CVE-2021-21409 | 5.9 | Mar 30 | Possible request smuggling in HTTP/2 due missing validation of content-length Affected: < 4.1.61.Final |
| CVE-2021-21295 | 5.9 | Mar 9 | Possible request smuggling in HTTP/2 due missing validation Affected: before 4.1.60 |
| CVE-2026-59919 | 5.5 | Jul 29 | Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address Affected: < 4.1.136.Final; >= 4.2.0.Final, < 4.2.16.Final |
| CVE-2025-59419 | 5.5 | Oct 15 | Netty netty-codec-smtp SMTP Command Injection Vulnerability Allowing Email Forgery Affected: < 4.2.7.Final; >= 4.2.0.Alpha1, < 4.1.128.Final |
| CVE-2025-25193 | 5.5 | Feb 10 | Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final Affected: before 4.1.118 |
| CVE-2024-47535 | 5.5 | Nov 12 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients Affected: before 4.1.115 |
| CVE-2022-24823 | 5.5 | May 6 | Netty is an open-source, asynchronous event-driven network application framework Affected: before 4.1.77 |
| CVE-2021-21290 | 5.5 | Feb 8 | Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files Affected: < 4.1.59.Final |
| CVE-2026-59900 | 5.3 | Jul 29 | Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass Affected: >= 4.2.0.Final, < 4.2.16.Final; < 4.1.136.Final |
| CVE-2026-50560 | 5.3 | Jun 12 | Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature Affected: >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final |
| CVE-2026-50020 | 5.3 | Jun 12 | Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted Affected: >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final |
| CVE-2026-47244 | 5.3 | Jun 12 | Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced Affected: >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final |
| CVE-2026-41417 | 5.3 | May 6 | Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri() Affected: >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final |
| CVE-2024-29025 | 5.3 | Mar 25 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients Affected: before 4.1.108 |
| CVE-2026-50009 | 4.8 | Jun 12 | Netty QUIC stateless reset token material exposed through header-visible connection IDs Affected: >= 4.2.0.Final, < 4.2.15.Final |
| CVE-2026-45536 | 4.0 | Jun 12 | Netty: Unix-socket fd receive leaks descriptors when peer sends two at once Affected: >= 4.2.0.Final, < 4.2.15.Final; < 4.1.135.Final |
Showing 28