Netty

Netty

92 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.1

CVE-2026-42586

Exploit
  • EPSS 0.2%
  • Veröffentlicht 13.05.2026 18:20:46
  • Zuletzt bearbeitet 18.05.2026 18:02:43

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating...

7.5

CVE-2026-42585

Exploit
  • EPSS 0.25%
  • Veröffentlicht 13.05.2026 18:12:39
  • Zuletzt bearbeitet 18.05.2026 12:24:23

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4...

9.1

CVE-2026-42584

Medienbericht Exploit
  • EPSS 0.78%
  • Veröffentlicht 13.05.2026 18:10:48
  • Zuletzt bearbeitet 13.08.2026 13:18:56

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pi...

7.5

CVE-2026-42583

Exploit
  • EPSS 0.43%
  • Veröffentlicht 13.05.2026 18:09:19
  • Zuletzt bearbeitet 18.05.2026 12:22:15

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header ...

7.5

CVE-2026-42582

Exploit
  • EPSS 0.44%
  • Veröffentlicht 13.05.2026 18:06:55
  • Zuletzt bearbeitet 10.07.2026 13:44:19

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for...

6.5

CVE-2026-42580

Exploit
  • EPSS 0.36%
  • Veröffentlicht 13.05.2026 18:04:03
  • Zuletzt bearbeitet 18.05.2026 14:03:25

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.1...

9.1

CVE-2026-42579

Medienbericht Exploit
  • EPSS 1.01%
  • Veröffentlicht 13.05.2026 18:01:52
  • Zuletzt bearbeitet 13.08.2026 13:18:55

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack...

7.5

CVE-2026-42577

  • EPSS 0.41%
  • Veröffentlicht 13.05.2026 18:00:28
  • Zuletzt bearbeitet 18.05.2026 14:05:07

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are ...

7.5

CVE-2026-42578

Exploit
  • EPSS 1.07%
  • Veröffentlicht 13.05.2026 17:57:43
  • Zuletzt bearbeitet 13.08.2026 13:18:55

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method create...

9.8

CVE-2026-42581

Exploit
  • EPSS 0.63%
  • Veröffentlicht 13.05.2026 17:54:44
  • Zuletzt bearbeitet 13.08.2026 13:18:56

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but...