io.netty:netty-codec-http (Maven)
Advisories
42
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.2.17.Final or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>io.netty</groupId><artifactId>netty-codec-http</artifactId><version>4.2.17.Final</version></dependency>gradle
implementation("io.netty:netty-codec-http:4.2.17.Final")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-8c42-7qj2-3j46 Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite |
High EPSS 0.32% |
< 4.1.137.Final | 4.1.137.Final |
| GHSA-8c42-7qj2-3j46 Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite |
High EPSS 0.32% |
>= 4.2.0.Final, < 4.2.17.Final | 4.2.17.Final |
| GHSA-gcjf-9mgh-3p7g Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder |
Medium EPSS 0.46% |
>= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| GHSA-gcjf-9mgh-3p7g Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder |
Medium EPSS 0.46% |
< 4.1.136.Final | 4.1.136.Final |
| GHSA-q4f6-jm68-57ww Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service |
High EPSS 0.61% |
< 4.1.136.Final | 4.1.136.Final |
| GHSA-q4f6-jm68-57ww Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service |
High EPSS 0.61% |
>= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| GHSA-4mp9-239f-g9hg Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation |
High EPSS 0.44% |
< 4.1.136.Final | 4.1.136.Final |
| GHSA-4mp9-239f-g9hg Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation |
High EPSS 0.44% |
>= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| GHSA-6cqp-g7gg-8hr5 Netty: Security Control Bypass via CORS Short-Circuit Failure |
Medium EPSS 0.41% |
< 4.1.136.Final | 4.1.136.Final |
| GHSA-6cqp-g7gg-8hr5 Netty: Security Control Bypass via CORS Short-Circuit Failure |
Medium EPSS 0.41% |
>= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| GHSA-jppx-w49h-x2qq Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion |
High EPSS 0.63% |
>= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| GHSA-jppx-w49h-x2qq Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion |
High EPSS 0.63% |
>= 4.1.0.Final, < 4.1.136.Final | 4.1.136.Final |
| GHSA-mvh2-crg5-v77c Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation |
High EPSS 0.66% |
>= 4.1.0.Final, < 4.1.136.Final | 4.1.136.Final |
| GHSA-mvh2-crg5-v77c Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation |
High EPSS 0.66% |
>= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| GHSA-6jqx-86gh-f27w Netty SPDY SETTINGS frame count materializes unbounded settings map |
High EPSS 0.66% |
>= 4.2.0.Final, < 4.2.16.Final | 4.2.16.Final |
| GHSA-6jqx-86gh-f27w Netty SPDY SETTINGS frame count materializes unbounded settings map |
High EPSS 0.66% |
>= 4.1.0.Final, < 4.1.136.Final | 4.1.136.Final |
| GHSA-hvcg-qmg6-jm4c Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted |
Medium EPSS 0.23% |
>= 4.2.0.Final, < 4.2.15.Final | 4.2.15.Final |
| GHSA-hvcg-qmg6-jm4c Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted |
Medium EPSS 0.23% |
< 4.1.135.Final | 4.1.135.Final |
| GHSA-f6hv-jmp6-3vwv Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS |
High EPSS 0.99% |
< 4.1.133.Final | 4.1.133.Final |
| GHSA-f6hv-jmp6-3vwv Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS |
High EPSS 0.99% |
>= 4.2.0.Alpha1, < 4.2.13.Final | 4.2.13.Final |
| GHSA-38f8-5428-x5cv Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding |
High EPSS 0.27% |
>= 4.2.0.Alpha1, < 4.2.13.Final | 4.2.13.Final |
| GHSA-38f8-5428-x5cv Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding |
High EPSS 0.27% |
< 4.1.133.Final | 4.1.133.Final |
| GHSA-57rv-r2g8-2cj3 Netty has HttpClientCodec response desynchronization |
Critical EPSS 0.84% |
>= 4.2.0.Alpha1, < 4.2.13.Final | 4.2.13.Final |
| GHSA-57rv-r2g8-2cj3 Netty has HttpClientCodec response desynchronization |
Critical EPSS 0.84% |
< 4.1.133.Final | 4.1.133.Final |
| GHSA-xxqh-mfjm-7mv9 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization |
Critical EPSS 0.63% |
>= 4.2.0.Alpha1, < 4.2.13.Final | 4.2.13.Final |
| GHSA-xxqh-mfjm-7mv9 Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization |
Critical EPSS 0.63% |
< 4.1.133.Final | 4.1.133.Final |
| GHSA-m4cv-j2px-7723 Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing |
Medium EPSS 0.38% |
>= 4.2.0.Alpha1, < 4.2.13.Final | 4.2.13.Final |
| GHSA-m4cv-j2px-7723 Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing |
Medium EPSS 0.38% |
< 4.1.133.Final | 4.1.133.Final |
| GHSA-v8h7-rr48-vmmv Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection |
Medium EPSS 0.32% |
>= 4.2.0.Alpha1, < 4.2.13.Final | 4.2.13.Final |
| GHSA-v8h7-rr48-vmmv Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection |
Medium EPSS 0.32% |
< 4.1.133.Final | 4.1.133.Final |
| GHSA-pwqr-wmgm-9rr8 Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing |
High EPSS 0.70% |
>= 4.2.0.Alpha1, < 4.2.10.Final | 4.2.10.Final |
| GHSA-pwqr-wmgm-9rr8 Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing |
High EPSS 0.70% |
< 4.1.132.Final | 4.1.132.Final |
| GHSA-84h7-rjj3-6jx4 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder |
Medium EPSS 0.32% |
< 4.1.129.Final | 4.1.129.Final |
| GHSA-84h7-rjj3-6jx4 Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder |
Medium EPSS 0.32% |
>= 4.2.0.Alpha1, < 4.2.8.Final | 4.2.8.Final |
| GHSA-fghv-69vj-qj49 Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions |
Low EPSS 0.71% |
>= 4.2.0.Alpha1, < 4.2.5.Final | 4.2.5.Final |
| GHSA-fghv-69vj-qj49 Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions |
Low EPSS 0.71% |
< 4.1.125.Final | 4.1.125.Final |
| GHSA-5jpm-x58v-624v Netty's HttpPostRequestDecoder can OOM |
Medium EPSS 1.38% |
< 4.1.108.Final | 4.1.108.Final |
| GHSA-hh82-3pmq-7frp Netty vulnerable to HTTP Response splitting from assigning header value iterator |
Medium EPSS 0.95% |
>= 4.1.83.Final, < 4.1.86.Final | 4.1.86.Final |
| GHSA-269q-hmxg-m83q Local Information Disclosure Vulnerability in io.netty:netty-codec-http |
Medium EPSS 1.04% |
< 4.1.77.Final | 4.1.77.Final |
| GHSA-wx5j-54mm-rqqq HTTP request smuggling in netty |
Medium EPSS 2.88% |
>= 4.0.0, < 4.1.71.Final | 4.1.71.Final |
| GHSA-5mcr-gq6c-3hq2 Local Information Disclosure Vulnerability in Netty on Unix-Like systems |
Medium EPSS 1.78% |
>= 4.0.0, < 4.1.59.Final | 4.1.59.Final |
| GHSA-cqqj-4p63-rrmm HTTP Request Smuggling in Netty |
Critical EPSS 8.91% |
< 4.1.44 | 4.1.44 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor