io.netty/netty-codec-http vulnerabilities
CVEs whose affected-version data names the io.netty/netty-codec-http package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-93558High· 7.5PoCA flaw was found in Netty's WebSocketServerExtensionHandler
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unboun…
CVE-2026-93565High· 7.5A flaw was found in Netty RtspDecoder
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a spe…
CVE-2026-93491High· 7.5A flaw was found in Netty's HttpServerCodec
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to gr…
CVE-2026-93488High· 7.5A flaw was found in Netty
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can…