[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVqA_YsaiDnBDHm7hrdArJNrflb-GyT1eR7rvc4AnqjE":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":27,"kevVulnerabilities":85,"topProductsByCves":90,"seoMetadata":93,"meta":102},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":26},21461,"netty",2,29,1,278,"2025-09-04","n",[16,20],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},118676,259,27,{"id":21,"product_name":22,"version_count":23,"cve_count":9,"kev_count":24,"last_cve_update":25},118677,"netty-incubator-codec-ohttp",19,0,"2024-07-18","Netty is a technology vendor with 2 tracked products and 29 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[28,36,44,51,56,61,65,70,75,79],{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"cvssVersion":33,"severity":34,"isKev":4,"epssScore":35},"CVE-2023-44487","The HTTP\u002F2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.","2023-10-10",7.5,"v3.1","High",0.99999,{"cveId":37,"description":38,"publishedDate":39,"cvssScore":40,"cvssVersion":33,"severity":41,"isKev":42,"epssScore":43},"CVE-2021-21295","Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request smuggling. If a Content-Length header is present in the original HTTP\u002F2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up. This is fine as long as the request is not proxied through as HTTP\u002F1.1. If the request comes in as an HTTP\u002F2 stream, gets converted into the HTTP\u002F1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP\u002F1.1 this may result in request smuggling. In a proxy case, users may assume the content-length is validated somehow, which is not the case. If the request is forwarded to a backend channel that is a HTTP\u002F1.1 connection, the Content-Length now has meaning and needs to be checked. An attacker can smuggle requests inside the body as it gets downgraded from HTTP\u002F2 to HTTP\u002F1.1. For an example attack refer to the linked GitHub Advisory. Users are only affected if all of this is true: `HTTP2MultiplexCodec` or `Http2FrameCodec` is used, `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP\u002F1.1 objects, and these HTTP\u002F1.1 objects are forwarded to another remote peer. This has been patched in 4.1.60.Final As a workaround, the user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.","2021-03-09",5.9,"Medium",false,0.18891,{"cveId":45,"description":46,"publishedDate":47,"cvssScore":48,"cvssVersion":33,"severity":49,"isKev":42,"epssScore":50},"CVE-2019-20445","HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.","2020-01-29",9.1,"Critical",0.13834,{"cveId":52,"description":53,"publishedDate":54,"cvssScore":32,"cvssVersion":33,"severity":34,"isKev":42,"epssScore":55},"CVE-2016-4970","handler\u002Fssl\u002FOpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).","2017-04-13",0.11259,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":32,"cvssVersion":33,"severity":34,"isKev":42,"epssScore":60},"CVE-2020-11612","The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.","2020-04-07",0.09188,{"cveId":62,"description":63,"publishedDate":47,"cvssScore":48,"cvssVersion":33,"severity":49,"isKev":42,"epssScore":64},"CVE-2019-20444","HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an \"invalid fold.\"",0.08914,{"cveId":66,"description":67,"publishedDate":68,"cvssScore":32,"cvssVersion":33,"severity":34,"isKev":42,"epssScore":69},"CVE-2019-16869","Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a \"Transfer-Encoding : chunked\" line), which leads to HTTP request smuggling.","2019-09-26",0.08645,{"cveId":71,"description":72,"publishedDate":73,"cvssScore":32,"cvssVersion":33,"severity":34,"isKev":42,"epssScore":74},"CVE-2021-37137","The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.","2021-10-19",0.06565,{"cveId":76,"description":77,"publishedDate":73,"cvssScore":32,"cvssVersion":33,"severity":34,"isKev":42,"epssScore":78},"CVE-2021-37136","The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack",0.05908,{"cveId":80,"description":81,"publishedDate":82,"cvssScore":32,"cvssVersion":83,"severity":34,"isKev":42,"epssScore":84},"CVE-2015-2156","Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.","2017-10-18","v3.0",0.05222,[86],{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"cvssVersion":33,"severity":34,"isKev":4,"epssScore":35,"cisaVulnName":87,"cisaDateAdded":31,"cisaShortDescription":88,"cisaRequiredAction":89},"HTTP\u002F2 Rapid Reset Attack Vulnerability","HTTP\u002F2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).","Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",[91,92],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":9,"kev_count":24,"last_cve_update":25},{"title":94,"metaDescription":95,"keywords":96,"structuredData":97},"Netty - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Netty covering 2 products with 29 tracked vulnerabilities including 0 critical and 1 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Netty vulnerabilities, Netty security, Netty CVE, Netty threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Netty KEV, Netty exploited vulnerabilities",{"@context":98,"@type":99,"name":100,"description":95,"url":101},"https:\u002F\u002Fschema.org","Organization","Netty","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fnetty",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":103,"apiVersion":104},"2026-10-17T13:04:10.790Z","3.0"]