netty vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-116541 Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes conHigh 8.2 · Oct 26, 2026
• CVE-2026-116540 netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticHigh 8.2 · Oct 26, 2026
• CVE-2026-116539 Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap theHigh 8.2 · Oct 26, 2026
• CVE-2026-100665 Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plaiHigh 8.7 · Sep 26, 2026
• CVE-2026-100664 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host headHigh 8.7 · Sep 26, 2026
• CVE-2026-100663 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets whenHigh 8.7 · Sep 26, 2026
• CVE-2026-100662 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPHigh 8.7 · Sep 26, 2026
• CVE-2026-100661 Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-inteHigh 8.7 · Sep 26, 2026
• CVE-2026-100660 Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state.High 8.7 · Sep 26, 2026
• CVE-2026-54251 netty-incubator-codec-ohttp implements Oblivious HTTP (OHTTP) gateway and client functionality using Netty.High 8.7 · Sep 15, 2026
• CVE-2026-62243 Netty (io.netty:netty-handler) versions from 4.2.0.Final through 4.2.16.Final and versions through 4.1.136.Final disable TLS hostname verification on the SslProHigh 8.7 · Aug 22, 2026
• CVE-2026-75596 Netty is an asynchronous, event-driven network application framework.High 8.7 · Aug 19, 2026
• CVE-2026-75595 Netty is an asynchronous, event-driven network application framework.Critical 9.1 · Aug 19, 2026
• CVE-2026-59902 Netty is an asynchronous, event-driven network application framework.High 7.5 · Aug 17, 2026
• CVE-2026-73507 Netty is an asynchronous, event-driven network application framework.High 7.5 · Aug 13, 2026
• CVE-2026-59901 Netty is an asynchronous, event-driven network application framework.High 8.7 · Jul 29, 2026
• CVE-2026-56822 Netty is an asynchronous, event-driven network application framework.High 7.4 · Jul 28, 2026
• CVE-2026-56821 Netty is an asynchronous, event-driven network application framework.High 7.4 · Jul 28, 2026
• CVE-2026-56820 Netty is a network application framework for development of protocol servers and clients.High 7.4 · Jul 21, 2026
• CVE-2026-56819 Netty is a network application framework for development of protocol servers and clients.High 7.5 · Jul 21, 2026
• CVE-2026-56817 Netty is a network application framework for development of protocol servers and clients.High 8.3 · Jul 21, 2026
• CVE-2026-56816 Netty is a network application framework for development of protocol servers and clients.High 7.5 · Jul 21, 2026
• CVE-2026-56745 Netty is a network application framework for development of protocol servers and clients.High 8.7 · Jul 21, 2026
• CVE-2026-55851 Netty is a network application framework for development of protocol servers and clients.High 8.7 · Jul 21, 2026
• CVE-2026-55833 Netty is a network application framework for development of protocol servers and clients.High 7.5 · Jul 20, 2026