Advisories · Technology
netty.
Every CVE that names netty among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
- netty
- HTTP request smuggling
- CVSS 8.7 High
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
- netty
- Weak cryptography or TLS
- CVSS 8.7 High
Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion
- netty
- CWE-20
- CVSS 8.7 High
Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3
- netty
- CWE-20
- CVSS 8.7 High
Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
- netty
- Denial of service
- CVSS 8.7 High
Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation
- netty
- Denial of service
- CVSS 8.7 High
Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
- netty
- Denial of service
- CVSS 6.9 Medium
Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass
- netty
- HTTP request smuggling
- CVSS 6.9 Medium
Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding
- netty
- HTTP request smuggling
- CVSS 3.5 Low
Netty: MQTT Topic Name and Client ID Validation Bypass
- netty
- CWE-20
- CWE-626
- CVSS 6.3 Medium
Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection
- netty
- CWE-626
- CVSS 8.7 High
Netty 4.2.0 through 4.2.16 TLS Hostname Verification Bypass
- netty
- Weak cryptography or TLS