Security
فارسی
All products

io.netty:netty-codec-http2

Maven · Package
11 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionCVE-2026-48043 · GHSA-C2GF-V879-257J io.netty:netty-codec-http2OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 MavenRed Hat Medium Fix reported
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)CVE-2026-56819 · GHSA-93WV-JW9V-4972 io.netty:netty-codec-http2OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 MavenRed Hat High Fix reported
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing BypassCVE-2026-59900 · GHSA-C69G-56F8-XWQJ io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 MavenRed Hat Medium Fix reported
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoSCVE-2026-42587 · GHSA-F6HV-JMP6-3VWV io.netty:netty-codec-http2io.netty:netty-codec-http MavenRed Hat High Fix reported
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signatureCVE-2026-50560 · GHSA-563Q-J3CM-6JXM io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 MavenRed Hat Medium Fix reported
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforcedCVE-2026-47244 · GHSA-5X3R-WRVG-RP6Q io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 MavenRed Hat Medium Fix reported
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame BypassCVE-2026-33871 · GHSA-W9FJ-CFPG-GRVV io.netty:netty-codec-http2Cryostat 4/netty-codec-http2 MavenRed Hat High Fix reported
Netty affected by MadeYouReset HTTP/2 DDoS vulnerabilityCVE-2025-55163 · GHSA-PRJ3-CCX8-P6X4 io.grpc:grpc-netty-shadedio.netty:netty-codec-http2 MavenRed Hat High Fix reported
io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset AttackGHSA-XPW8-RCWV-8F8P io.netty:netty-codec-http2 Maven High Fix reported
Possible request smuggling in HTTP/2 due missing validation of content-lengthCVE-2021-21409 · GHSA-F256-J965-7F32 io.netty:netty-codec-http2io.netty:netty MavenRed Hat Medium Fix reported
Possible request smuggling in HTTP/2 due missing validationCVE-2021-21295 · GHSA-WM47-8V5P-WJPJ io.netty:netty-codec-http2io.netty:netty MavenRed Hat Medium Fix reported