netty-codec-http3
by Netty
Source repositories
CVEs (12)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-100664 | Hig | 0.42 | 7.5 | 0.00 | Sep 26, 2026 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In… | ||
| CVE-2026-100663 | Hig | 0.42 | 7.5 | 0.00 | Sep 26, 2026 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target (e.g., "CONNECT… | ||
| CVE-2026-100662 | Hig | 0.42 | 7.5 | 0.00 | Sep 26, 2026 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK… | ||
| CVE-2026-100661 | Hig | 0.42 | 7.5 | 0.00 | Sep 26, 2026 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A… | ||
| CVE-2026-100660 | Hig | 0.42 | 7.5 | 0.00 | Sep 26, 2026 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed… | ||
| CVE-2026-93574 | Med | 0.42 | 6.5 | 0.01 | Sep 18, 2026 | A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling.… | ||
| CVE-2026-100666 | Hig | 0.40 | 7.3 | 0.00 | Sep 26, 2026 | Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational… | ||
| CVE-2026-100659 | Med | 0.35 | 6.5 | 0.00 | Sep 26, 2026 | Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated… | ||
| CVE-2021-21295 | Med | 0.33 | 5.9 | 0.19 | Mar 9, 2021 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request… | ||
| CVE-2026-100658 | 0.00 | — | 0.00 | Sep 26, 2026 | Rejected reason: This CVE ID has been rejected as a duplicate. | |||
| CVE-2026-100656 | 0.00 | — | 0.00 | Sep 26, 2026 | Rejected reason: This CVE ID has been rejected as a duplicate. | |||
| CVE-2026-100655 | 0.00 | — | 0.00 | Sep 26, 2026 | Rejected reason: This CVE ID has been rejected as a duplicate. |
- risk 0.42cvss 7.5epss 0.00
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form HTTP/1 request-target. In…
- risk 0.42cvss 7.5epss 0.00
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form request-targets when converting HTTP/1 messages to HTTP/3 in HttpConversionUtil.toHttp3Headers. The authority-form target (e.g., "CONNECT…
- risk 0.42cvss 7.5epss 0.00
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vulnerability in the QPACK encoder-stream instruction decoder (QpackEncoderHandler, installed on the peer-initiated unidirectional QPACK…
- risk 0.42cvss 7.5epss 0.00
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder (QpackUtil.decodePrefixedInteger), which does not bound the number of continuation bytes it will process. A…
- risk 0.42cvss 7.5epss 0.00
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. QpackEncoder stores a queue and a dynamic-table index tracker for every encoded field section that references the QPACK dynamic table, keyed…
- risk 0.42cvss 6.5epss 0.01
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling.…
- risk 0.40cvss 7.3epss 0.00
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136.Final pairs each outbound response with an inbound request by calling pollMethod() once per response, including for 1xx informational…
- risk 0.35cvss 6.5epss 0.00
Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement that the :authority pseudo-header field and a literal host header field, when both present, carry the same value. A remote unauthenticated…
- risk 0.33cvss 5.9epss 0.19
Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.60.Final there is a vulnerability that enables request…
- CVE-2026-100658Sep 26, 2026risk 0.00cvss —epss 0.00
Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-100656Sep 26, 2026risk 0.00cvss —epss 0.00
Rejected reason: This CVE ID has been rejected as a duplicate.
- CVE-2026-100655Sep 26, 2026risk 0.00cvss —epss 0.00
Rejected reason: This CVE ID has been rejected as a duplicate.