netty netty vulnerabilities

CVEs per yearBy the year they were published

1. 20213
2. 20223
3. 20231
4. 20242
5. 20257
6. 202675

Newest CVEs

• CVE-2026-100666

  Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec

  netty · netty

  Medium6.9
• CVE-2026-100665

  Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

  netty · netty

  High8.7
• CVE-2026-100664

  Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

  netty · netty

  High8.7
• CVE-2026-100663

  Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

  netty · netty

  High8.7
• CVE-2026-100662

  Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

  netty · netty

  High8.7
• CVE-2026-100661

  Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

  netty · netty

  High8.7
• CVE-2026-100660

  Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

  netty · netty

  High8.7
• CVE-2026-100659

  Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

  netty · netty

  Medium6.9
• CVE-2026-89044

  Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding

  netty · netty

  Medium6.9
• CVE-2026-76816

  Netty: MQTT Topic Name and Client ID Validation Bypass

  netty · netty

  Low3.5