Netty
Vulnerability activity for Netty: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 15
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 7.5HighAug 22, 2026netty Auth bypass / access controlCVE-2026-62243Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProvider.OPENSSL client path when a plain (non-extended) X509TrustManager is used and Unsafe-based trust-manager wrapping is unavailable (Java 25+). In this configuration the OpenSSL client does not perform hostname verification, allowing a man-in-the-middle attacker to present a certificate issued for a different hostname that is accepted w
- 9.1CriticalAug 19, 2026nettyCVE-2026-75595Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause a
- 8.7HighAug 19, 2026nettyCVE-2026-75596Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy all previously received body bytes for every additional TLS record. An unauthenticated remote peer c
- 7.5HighAug 13, 2026netty Denial of serviceCVE-2026-73507Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final a
- 8.7HighJul 29, 2026netty Denial of serviceCVE-2026-59901Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-lo
- 8.7HighJul 21, 2026netty Denial of serviceCVE-2026-56745Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `S
- 7.5HighJun 12, 2026netty Crypto / certificateCVE-2026-50010Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X50
- 7.5HighJun 12, 2026netty Denial of serviceCVE-2026-45416Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().1.6% likely
- 8.1HighJun 11, 2026netty Auth bypass / access controlCVE-2026-44249Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can1.3% likely
- 7.5HighMay 13, 2026netty Denial of serviceCVE-2026-42587Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate en1% likely
- 6.8MediumMay 13, 2026nettyCVE-2026-42586Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the R
- 6.5MediumMay 13, 2026nettyCVE-2026-42585Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
- 7.5HighMay 13, 2026netty Denial of serviceCVE-2026-42583Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if
- 8.7HighMar 27, 2026netty Denial of serviceCVE-2026-33871Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of a limit on the number of `CON1.2% likely
- 7.5HighMar 27, 2026nettyCVE-2026-33870Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix t
- 6.9MediumSep 3, 2025nettyCVE-2025-58057Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted inp
- 2.9LowSep 3, 2025nettyCVE-2025-58056Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts standalone newline characters (LF) as a chunk-size line termin
- 8.2HighAug 13, 2025netty Denial of serviceCVE-2025-55163Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.1.1% likely
- 7.5HighFeb 10, 2025nettyCVE-2025-24970Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which can lead to2.2% likely
Top products
- netty15 CVEs in the last year, 1 critical
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Atlassian · Oct 20, 2026Atlassian Security Bulletin October 20, 2026CVE-2026-62243CVE-2026-75596
- Atlassian · Sep 15, 2026Atlassian Security Bulletin September 15, 2026CVE-2026-44249CVE-2026-73507CVE-2026-75595
- Atlassian · Aug 18, 2026Atlassian Security Bulletin August 18, 2026CVE-2026-56745CVE-2026-59901
- Atlassian · Jul 21, 2026Atlassian Security Bulletin July 21, 2026CVE-2026-33871CVE-2026-44249CVE-2026-45416CVE-2026-50010
- Atlassian · Jun 16, 2026Atlassian Security Bulletin June 16, 2026CVE-2026-42583CVE-2026-42585CVE-2026-42587
- Atlassian · Apr 21, 2026Atlassian Security Bulletin April 21, 2026CVE-2026-33870CVE-2026-33871
- Atlassian · Jan 20, 2026Atlassian Security Bulletin January 20, 2026CVE-2025-55163
- Atlassian · Dec 11, 2025Atlassian Security Bulletin December 11, 2025CVE-2025-55163
- Atlassian · Nov 18, 2025Atlassian Security Bulletin November 18, 2025CVE-2025-55163
- Atlassian · Oct 21, 2025Atlassian Security Bulletin October 21, 2025CVE-2025-58056CVE-2025-58057
- Atlassian · Jun 17, 2025Atlassian Security Bulletin June 17, 2025CVE-2025-24970
- Atlassian · May 20, 2025Atlassian Security Bulletin May 20, 2025CVE-2025-24970
- Atlassian · Apr 15, 2025Atlassian Security Bulletin April 15, 2025CVE-2025-24970
- Atlassian · Mar 18, 2025Atlassian Security Bulletin March 18, 2025CVE-2025-24970
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.