Vulnerabilities in netty
103 resultsCVE-2026-48043MEDIUMnetty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionEPSS 0.8%CVE-2026-48006HIGHNetty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregatorEPSS 0.7%CVE-2026-44891HIGHNetty: Denial of Service via Unbounded Headers in StompSubframeDecoderEPSS 0.7%CVE-2025-58056LOWNetty is vulnerable to request smuggling due to incorrect parsing of chunk extensionsEPSS 0.7%CVE-2026-33870HIGHNetty: HTTP Request Smuggling via Chunked Extension Quoted-String ParsingEPSS 0.7%CVE-2026-56817HIGHNetty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabledEPSS 0.7%CVE-2024-40642HIGHAbsent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp EPSS 0.7%CVE-2026-55833HIGHNetty SPDY zlib header block continues decoded expansion after maxHeaderSize truncationEPSS 0.7%CVE-2026-56819HIGHNetty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)EPSS 0.7%CVE-2026-55831HIGHNetty SPDY SETTINGS frame count materializes unbounded settings mapEPSS 0.7%CVE-2026-56816HIGHNetty: Memory Exhaustion via HTTP/3 Reserved Frame TypesEPSS 0.6%CVE-2025-58057MEDIUMNetty's BrotliDecoder is vulnerable to DoS via zip bomb style attackEPSS 0.6%CVE-2026-73508MEDIUMNetty: Memory Leak in DNS Record Decoder via Malformed Domain NamesEPSS 0.6%CVE-2026-56745HIGHNetty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory ExhaustionEPSS 0.6%CVE-2026-55851HIGHNetty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory ExhaustionEPSS 0.6%CVE-2026-42581MEDIUMNetty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling SanitizationEPSS 0.6%CVE-2026-48059HIGHNetty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionEPSS 0.6%CVE-2026-44893HIGHNetty: HAProxy SSL TLV parsing leaks retained slice on invalid TLV lengthEPSS 0.6%CVE-2026-59899MEDIUMNetty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of ServiceEPSS 0.6%CVE-2026-46340HIGHNetty: SCTP reassembly nests buffers without boundEPSS 0.6%