Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: netty 4.2.18.Final Clear all filters
TI-2026-64821 CVE-2026-100665 · GHSA-4qw4-fmqv-qhv8

Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

Priority HIGH 77

Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00367 Published 2026-09-26 Partial fix · 4.2.18.Final CWE-295
TI-2026-64820 CVE-2026-100664 · GHSA-gjrj-m8xc-f2cm

Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion

Priority MEDIUM 44

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0033 Published 2026-09-26 Partial fix · 4.2.18.Final CWE-20
TI-2026-64819 CVE-2026-100663 · GHSA-qmrm-mg2w-2mpw

Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

Priority HIGH 71

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00301 Published 2026-09-26 Partial fix · 4.2.18.Final CWE-20
TI-2026-64818 CVE-2026-100662 · GHSA-w648-8654-gr82

Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

Priority HIGH 77

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler,…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00416 Published 2026-09-26 Partial fix · 4.2.18.Final CWE-400
TI-2026-64817 CVE-2026-100661 · GHSA-7m86-g9j9-26xf

Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

Priority MEDIUM 44

Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does no…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00344 Published 2026-09-26 Partial fix · 4.2.18.Final CWE-400
TI-2026-64816 CVE-2026-100660 · GHSA-8rpm-pm7h-f5fv

Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

Priority HIGH 77

Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00454 Published 2026-09-26 Partial fix · 4.2.18.Final CWE-770
TI-2026-64815 CVE-2026-100659 · GHSA-7j27-hw46-m8m8

Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass

Priority LOW 36

Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00236 Published 2026-09-26 Partial fix · 4.2.18.Final CWE-444