netty-codec-http vulnerabilities

3 known vulnerabilities in netty-codec-http from Io.netty. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  netty: Uncontrolled Resource Consumption

  CVE-2026-42587May 13, 2026Netty

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is co

• 7.5 High severity

  netty: Inconsistent Interpretation of HTTP Requests

  CVE-2026-42585May 13, 2026Netty

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Fin

• 9.1 Critical severity

  netty: Inconsistent Interpretation of HTTP Requests

  CVE-2026-42584May 13, 2026Netty

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GE