Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 81
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0063 · Published 2026-05-13 · Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444
Priority HIGH 78
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00838 · Published 2026-05-13 · Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444
Priority HIGH 78
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01006 · Published 2026-05-13 · Partial fix · 4.2.13.Final, 4.1.133.Final CWE-20
Priority HIGH 77
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00367 · Published 2026-09-26 · Partial fix · 4.2.18.Final CWE-295
Priority HIGH 77
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler,…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00416 · Published 2026-09-26 · Partial fix · 4.2.18.Final CWE-400
Priority HIGH 77
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00454 · Published 2026-09-26 · Partial fix · 4.2.18.Final CWE-770
Priority HIGH 75
Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00396 · Published 2026-10-26 · Partial fix · 2.0.84.Final CWE-787
Priority HIGH 74
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00313 · Published 2026-07-21 · Fixed in 4.2.16.Final, 4.1.136.Final CWE-295
Priority HIGH 72
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00665 · Published 2026-07-21 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority HIGH 72
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00665 · Published 2026-07-20 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-400
Priority HIGH 72
Netty is a network application framework for development of protocol servers and clients.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00728 · Published 2026-07-17 · Partial fix · 4.1.136.Final, 4.2.16.Final CWE-400
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0099 · Published 2026-05-13 · Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00267 · Published 2026-05-13 · Partial fix · 4.2.13.Final, 4.1.133.Final CWE-444
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00461 · Published 2026-05-13 · Partial fix · 4.2.13.Final, 4.1.133.Final CWE-400
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00437 · Published 2026-05-13 · Partial fix · 4.2.13.Final CWE-770
Priority HIGH 72
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00701 · Published 2026-03-27 · Partial fix · 4.1.132.Final, 4.2.10.Final CWE-444
Priority HIGH 72
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02192 · Published 2025-02-10 · Partial fix · 4.1.118.Final CWE-20
Priority HIGH 72
Netty project is an event-driven asynchronous network application framework.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01577 · Published 2022-12-12 · Partial fix · 4.1.86.Final CWE-674
Priority HIGH 71
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.…
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00301 · Published 2026-09-26 · Partial fix · 4.2.18.Final CWE-20
Priority HIGH 70
Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00208 · Published 2026-10-26 · Partial fix · 2.0.84.Final CWE-176
Priority HIGH 70
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMetho…
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00294 · Published 2026-09-26 · Partial fix · 4.2.17.Final, 4.1.137.Final CWE-444
Priority HIGH 68
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00173 · Published 2026-07-28 · Partial fix · 4.2.16.Final, 4.1.136.Final CWE-367
Priority HIGH 68
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00219 · Published 2026-07-28 · Partial fix · 4.1.136.Final, 4.2.16.Final CWE-299
Priority HIGH 68
Netty is an asynchronous, event-driven network application framework.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00473 · Published 2026-08-07 · Partial fix · 4.1.136.Final, 4.2.16.Final CWE-401
Load more
THREATIST.IORead the docs