Vendor
Netty
119 known vulnerabilities in products by Netty, 1 of them actively exploited (CISA KEV).
Key figures
119
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
13
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEValso in 160 other products | 7.5 | |
| Critical | CVE-2019-20445 | Netty: security vulnerability | 9.1 | |
| Critical | CVE-2019-20444 | Netty: security vulnerability | 9.1 | |
| High | CVE-2016-4970 | Netty: Infinite Loop | 7.5 | |
| High | CVE-2020-11612 | Netty: security vulnerability | 7.5 | |
| High | CVE-2019-16869 | Netty: security vulnerability | 7.5 | |
| High | CVE-2021-37137 | The Netty project Netty: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2021-37136 | The Netty project Netty: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2015-2156 | Lightbend Play Framework: Information Disclosure | 7.5 | |
| Medium | CVE-2021-21295 | Possible request smuggling in HTTP/2 due missing validation | 5.9 | |
| High | CVE-2020-7238 | Netty: security vulnerability | 7.5 | |
| High | CVE-2025-24970 | Netty: Improper Input Validation | 7.5 | |
| High | CVE-2026-42587 | Netty: Allocation of Resources Without Limits or Throttling | 7.5 | |
| Medium | CVE-2021-21409 | Possible request smuggling in HTTP/2 due missing validation of content-length | 5.9 | |
| High | CVE-2026-33871 | Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass | 7.5 | |
| Medium | CVE-2021-43797 | Netty: HTTP Request/Response Smuggling | 6.5 | |
| Critical | CVE-2026-56817 | Netty: Improper Restriction of XML External Entity Reference | 9.8 | |
| Medium | CVE-2023-34462 | netty-handler SniHandler 16MB allocation | 6.5 | |
| High | CVE-2026-44249 | Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking | 8.1 | |
| Critical | CVE-2026-42584 | Netty: HttpClientCodec response desynchronization | 9.1 | |
| High | CVE-2026-42578 | Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation | 7.5 | |
| Critical | CVE-2026-42579 | Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) | 7.5 | |
| High | CVE-2026-48006 | Netty's Lack of Lifecycle Cleanup Leads to Pooled ByteBuf Leak in RedisArrayAggregator | 7.5 | |
| High | CVE-2026-73507 | Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion | 7.5 | |
| High | CVE-2025-55163 | Netty MadeYouReset HTTP/2 DDoS Vulnerability | 7.5 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 23sans-atrisk-mail,
Products
| Netty | 108 | 1 |
| Netty netty-incubator-codec-ohttp | 6 | 0 |
| Netty-tcnative | 4 | 0 |
| Netty-tcnative-boringssl-static | 3 | 0 |