NE
Vendor
netty
117
CVEs
1
On KEV
7
New 30D
Products
NE5.9
netty-tcnative
netty
4 CVEs0 on KEV4 new
NE5.9
netty-tcnative-boringssl-static
netty
3 CVEs0 on KEV3 new
NE10.0
netty
netty
103 CVEs1 on KEV0 new
NE9.1
netty-incubator-codec-ohttp
netty
6 CVEs0 on KEV0 new
IO5.9
io.netty:netty-codec-http2
netty
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116542 New | NE netty-tcnative netty | 5.3 | Oct 26 | Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding |
| CVE-2026-116541 New | NE netty-tcnative netty | 5.9 | Oct 26 | netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount |
| CVE-2026-116540 New | NE netty-tcnative netty | 5.9 | Oct 26 | netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback |
| CVE-2026-116539 New | NE netty-tcnative-boringssl-static netty | 5.9 | Oct 26 | Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO |
| CVE-2026-100666 | NE netty netty | 7.3 | Sep 26 | Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec |
| CVE-2026-100665 | NE netty netty | 7.5 | Sep 26 | Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass |
| CVE-2026-100664 | NE netty netty | 7.5 | Sep 26 | Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion |
| CVE-2026-100663 | NE netty netty | 7.5 | Sep 26 | Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3 |
| CVE-2026-100662 | NE netty netty | 7.5 | Sep 26 | Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS |
| CVE-2026-100661 | NE netty netty | 7.5 | Sep 26 | Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation |
| CVE-2026-100660 | NE netty netty | 7.5 | Sep 26 | Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention |
| CVE-2026-100659 | NE netty netty | 6.5 | Sep 26 | Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass |
| CVE-2026-54251 | NE netty-incubator-codec-ohttp netty | 8.7 | Sep 15 | netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service |
| CVE-2026-89044 | NE netty netty | 6.5 | Sep 10 | Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding |
| CVE-2026-76816 | NE netty netty | 3.5 | Aug 24 | Netty: MQTT Topic Name and Client ID Validation Bypass |
| CVE-2026-62380 | NE netty netty | 7.5 | Aug 22 | Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection |
| CVE-2026-62243 | NE netty netty | 7.5 | Aug 22 | Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass |
| CVE-2026-75595 | NE netty netty | 9.1 | Aug 19 | Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| CVE-2026-75596 | NE netty netty | 7.5 | Aug 19 | Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing |
| CVE-2026-59903 | NE netty netty | 7.5 | Aug 17 | Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite |
| CVE-2026-59902 | NE netty netty | 7.5 | Aug 17 | Netty: Memory Exhaustion in SctpMessageCompletionHandler |
| CVE-2026-73508 | NE netty netty | 7.5 | Aug 13 | Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names |
| CVE-2026-73507 | NE netty netty | 7.5 | Aug 13 | Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion |
| CVE-2026-56818 | NE netty netty | 6.5 | Aug 7 | Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state |
| CVE-2026-59898 | NE netty netty | 7.5 | Jul 29 | Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation |
| CVE-2026-59899 | NE netty netty | 7.5 | Jul 29 | Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service |
| CVE-2026-59900 | NE netty netty | 5.3 | Jul 29 | Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass |
| CVE-2026-59901 | NE netty netty | 7.5 | Jul 29 | Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang |
| CVE-2026-59919 | NE netty netty | 5.5 | Jul 29 | Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address |
| CVE-2026-59920 | NE netty netty | 6.5 | Jul 29 | Netty: STOMP CONNECT Frame Header Injection |
| CVE-2026-56822 | NE netty netty | 7.4 | Jul 28 | Netty: TOCTOU in OcspServerCertificateValidator |
| CVE-2026-56821 | NE netty netty | 7.4 | Jul 28 | Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator |
| CVE-2026-59921 | NE netty netty | 6.5 | Jul 28 | Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder |
| CVE-2026-56820 | NE netty netty | 9.1 | Jul 21 | Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks |
| CVE-2026-56819 | NE netty netty | 7.5 | Jul 21 | Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS) |
| CVE-2026-56817 | NE netty netty | 9.8 | Jul 21 | Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled |
| CVE-2026-56816 | NE netty netty | 7.5 | Jul 21 | Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types |
| CVE-2026-56746 | NE netty netty | 6.5 | Jul 21 | Netty has a Security Control Bypass via CORS Short-Circuit Failure |
| CVE-2026-56745 | NE netty netty | 7.5 | Jul 21 | Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion |
| CVE-2026-55851 | NE netty netty | 7.5 | Jul 21 | Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion |
| CVE-2026-55833 | NE netty netty | 7.5 | Jul 20 | Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation |
| CVE-2026-55831 | NE netty netty | 7.5 | Jul 20 | Netty SPDY SETTINGS frame count materializes unbounded settings map |
| CVE-2026-44891 | NE netty netty | 7.5 | Jul 17 | Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder |
| CVE-2026-50560 | NE netty netty | 5.3 | Jun 12 | Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature |
| CVE-2026-50020 | NE netty netty | 5.3 | Jun 12 | Netty's HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted |
| CVE-2026-50011 | NE netty netty | 7.5 | Jun 12 | Netty has unbounded pre-allocation in RedisArrayAggregator from RESP array length |
| CVE-2026-50010 | NE netty netty | 7.5 | Jun 12 | Netty's wrapping plain trust manager silently disables hostname verification |
| CVE-2026-50009 | NE netty netty | 4.8 | Jun 12 | Netty QUIC stateless reset token material exposed through header-visible connection IDs |
| CVE-2026-48748 | NE netty netty | 7.5 | Jun 12 | Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion |
| CVE-2026-48059 | NE netty netty | 7.5 | Jun 12 | Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion |
| CVE-2026-48043 | NE netty netty | 7.5 | Jun 12 | netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion |
| CVE-2026-48006 | NE netty netty | 7.5 | Jun 12 | Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator |
| CVE-2026-47691 | NE netty netty | 10.0 | Jun 12 | Netty has Insufficient Bailiwick Validation for NS Records |
| CVE-2026-47244 | NE netty netty | 5.3 | Jun 12 | Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced |
| CVE-2026-46340 | NE netty netty | 7.5 | Jun 12 | Netty: SCTP reassembly nests buffers without bound |
| CVE-2026-45674 | NE netty netty | 10.0 | Jun 12 | Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records |
| CVE-2026-45673 | NE netty netty | 6.8 | Jun 12 | Netty: DNS Cache Poisoning due to Predictable PRNG and Default Static Source Port |
| CVE-2026-45536 | NE netty netty | 4.0 | Jun 12 | Netty: Unix-socket fd receive leaks descriptors when peer sends two at once |
| CVE-2026-45416 | NE netty netty | 7.5 | Jun 12 | Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes |
| CVE-2026-44894 | NE netty netty | 7.5 | Jun 12 | Netty's Default QUIC token handler accepts any client-supplied token |