netty vulnerabilities

CVEs per yearBy the year they were published

1. 20214
2. 20223
3. 20231
4. 20244
5. 20258
6. 202683

Newest CVEs

• CVE-2026-116542

  Netty netty-tcnative before 2.0.84.Final SNI Hostname Spoofing via Modified UTF-8 Decoding

  netty · netty-tcnative

  Medium6.9
• CVE-2026-116541

  netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

  netty · netty-tcnative

  High8.2
• CVE-2026-116540

  netty-tcnative 2.0.66.Final before 2.0.84.Final Use-After-Free in Session Ticket Callback

  netty · netty-tcnative

  High8.2
• CVE-2026-116539

  Netty netty-tcnative before 2.0.84.Final Heap Buffer Overflow via OpenSSL BIO

  netty · netty-tcnative

  High8.2
• CVE-2026-100666

  Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

  netty · netty

  Medium6.9
• CVE-2026-100665

  Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

  netty · netty

  High8.7
• CVE-2026-100664

  Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

  netty · netty

  High8.7
• CVE-2026-100663

  Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

  netty · netty

  High8.7
• CVE-2026-100662

  Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

  netty · netty

  High8.7
• CVE-2026-100661

  Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

  netty · netty

  High8.7