Netty

Netty

44 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
2.9

CVE-2026-42578

  • EPSS 0.05%
  • Veröffentlicht 13.05.2026 17:57:43
  • Zuletzt bearbeitet 14.05.2026 16:26:50

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method create...

5.8

CVE-2026-42581

  • EPSS 0.03%
  • Veröffentlicht 13.05.2026 17:54:44
  • Zuletzt bearbeitet 14.05.2026 16:26:50

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but...

5.3

CVE-2026-41417

Exploit
  • EPSS 0.06%
  • Veröffentlicht 06.05.2026 20:52:47
  • Zuletzt bearbeitet 11.05.2026 14:29:48

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the star...

7.5

CVE-2026-33871

Medienbericht
  • EPSS 0.04%
  • Veröffentlicht 27.03.2026 19:55:23
  • Zuletzt bearbeitet 30.03.2026 20:10:17

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. ...

7.5

CVE-2026-33870

Exploit
  • EPSS 0.02%
  • Veröffentlicht 27.03.2026 19:54:15
  • Zuletzt bearbeitet 30.03.2026 20:12:16

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling atta...

6.5

CVE-2025-67735

Exploit
  • EPSS 0.02%
  • Veröffentlicht 16.12.2025 00:19:11
  • Zuletzt bearbeitet 02.01.2026 18:50:23

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.HttpRequestEncoder` has a CRLF injection with the request URI when constructing a request. This...

5.5

CVE-2025-59419

  • EPSS 0.32%
  • Veröffentlicht 15.10.2025 15:42:30
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final, the SMTP codec in Netty contains an SMTP command injection vulnerability due to insufficient input validation for Carriage Retur...

7.5

CVE-2025-58057

Medienbericht Exploit
  • EPSS 0.07%
  • Veröffentlicht 03.09.2025 21:46:49
  • Zuletzt bearbeitet 08.09.2025 16:45:55

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final a...

7.5

CVE-2025-58056

Medienbericht Exploit
  • EPSS 0.04%
  • Veröffentlicht 03.09.2025 20:56:50
  • Zuletzt bearbeitet 08.09.2025 16:46:36

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone n...

7.5

CVE-2025-55163

Medienbericht Exploit
  • EPSS 0.05%
  • Veröffentlicht 13.08.2025 14:17:36
  • Zuletzt bearbeitet 04.11.2025 22:16:30

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 contro...