Netty

netty

86 CVEs • 2 products

Products (2)

Click to collapse

Toggle

Netty Incubator Codec Ohttp

netty-incubator-codec-ohttp

CVEs (86)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2020-7238 4Debian FedoraprojectNetty+1 more 6Debian Linux FedoraJboss Enterprise Application Platform+3 more Jun 17, 2026 Jan 27, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an inc...Show more Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.Show less
CVE-2019-16869 4Canonical DebianNetty+1 more 4Debian Linux Jboss Enterprise Application PlatformNetty+1 more Jun 17, 2026 Sep 26, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
CVE-2015-2156 3Lightbend NettyPlayframework 3Netty Play FrameworkPlay Framework May 13, 2026 Oct 18, 2017 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and ob...Show more Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.Show less
CVE-2016-4970 3Apache NettyRedhat 4Cassandra Jboss Data GridJboss Middleware Text Only Advisories+1 more May 13, 2026 Apr 13, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
CVE-2014-3488 1Netty 1Netty May 6, 2026 Jul 31, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
CVE-2014-0193 1Netty 1Netty May 6, 2026 May 6, 2014 N/A· v4 N/A· v3 5.0 MEDIUM· v2 WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a Tex...Show more WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.Show less

Previous 1 2 3 45