Netty

Null byte and CRLF injection in Netty's SOCKS4 and SOCKS5 client encoders (Socks4ClientEncoder, Socks5ClientEncoder) allows an attacker who controls domain address or authentication fields to truncate or alter proxy connection parameters, enabling domain spoofing, userid truncation, authentication data injection, and protocol confusion. Affected are all Netty releases in the 4.1.x branch through 4.1.136.Final and the 4.2.x branch through 4.2.16.Final - both branches have been patched. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the integrity impact on downstream SOCKS proxy routing is concrete.

TLS hostname verification is silently bypassed in Netty's OpenSSL client path, allowing a network man-in-the-middle attacker to intercept encrypted communications by presenting a certificate issued for a different hostname. Affected are applications using io.netty:netty-handler versions 4.2.0.Final through 4.2.16.Final or any 4.1.x through 4.1.136.Final, specifically when the SslProvider.OPENSSL client path is configured with a plain X509TrustManager and running on Java 25 or later, where Unsafe-based trust-manager wrapping is unavailable. No public exploit code has been identified at time of analysis, but the confidentiality impact is high for any affected deployment that transmits sensitive data over TLS.

Denial-of-service via quadratic CPU exhaustion in Netty's SniHandler affects all Netty deployments prior to 4.1.137.Final and 4.2.17.Final that use the default SniHandler constructors for TLS termination. An unauthenticated remote peer can fragment a large TLS ClientHello across thousands of small records, causing SslClientHelloHandler#decode to recopy all previously received bytes on every record arrival - O(N²) work that stalls the Netty event loop and denies TLS service to all concurrent clients. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept has been identified, but the low attack complexity and zero-authentication requirement make this a credible threat for any internet-exposed Netty TLS endpoint.

Netty's CorsHandler silently overwrites any application-set Vary headers with only 'Vary: Origin', enabling caching proxies and CDNs to conflate and serve authenticated, user-specific HTTP responses to unauthorized requesters. Affected are all Netty deployments running netty-codec-http prior to 4.1.137.Final or 4.2.17.Final where applications set per-user Vary headers (e.g., Vary: Authorization or Vary: Cookie) and are deployed behind a caching layer. No public exploit identified at time of analysis; vendor-released patches are confirmed available in 4.1.137.Final and 4.2.17.Final.

Memory exhaustion in Netty's SctpMessageCompletionHandler (netty-transport-sctp) allows unauthenticated remote peers to drive a JVM into OutOfMemoryError by sending oversized, incomplete SCTP message fragments. The handler enforces limits on concurrent incomplete messages and per-message fragment counts - introduced as a fix for the prior CVE-2026-46340 - but omits a corresponding cap on total buffered bytes. With default settings of 128 messages and 128 fragments, an attacker can buffer approximately 1GB per connection; a small number of concurrent connections suffices to exhaust server heap. Vendor-released patches exist in versions 4.1.137.Final and 4.2.17.Final; no active exploitation or public POC has been identified at time of analysis.

Direct memory exhaustion in Netty's DNS codec (netty-codec-dns) allows unauthenticated remote attackers to trigger incremental off-heap memory leaks by sending DNS packets containing malformed domain names. When IDN.toASCII() or encodeDomainName() throws an IllegalArgumentException due to IDNA rule violations or embedded null bytes, ByteBuf objects allocated or retained during record decoding are never released - accumulating until the JVM's direct memory is exhausted, producing a gradual denial of service. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; fixed releases are available.

CPU exhaustion denial of service in Netty's XmlFrameDecoder allows an unauthenticated remote attacker to hang a server's EventLoop thread by trickle-feeding repeated `</` byte sequences to any port where XmlFrameDecoder is in the pipeline. Because the decoder fails to save parser state between `decode()` invocations, each new call rescans the entire accumulated buffer from scratch, producing O(n²) CPU growth that can fully pin a thread with as little as 1 MB of malformed XML data. No public exploit code has been identified at time of analysis, though the GitHub Security Advisory GHSA-v74w-7mr3-4qg3 supplies sufficient technical detail to reproduce the attack. Vendor-released patches are available as Netty 4.1.136.Final and 4.2.16.Final.

Netty's RedisArrayAggregator codec fails to release retained partial aggregate state when the maxElements limit is exceeded, unlike the symmetric maxNestedArrayDepth branch which correctly calls releaseAndClearDepths() before throwing. In applications that keep the channel alive after a codec exception - a common resilience pattern - an unauthenticated peer can exploit this inconsistency to keep attacker-controlled ByteBuf references pinned in Netty's pooled buffer allocator and cause subsequent messages to be consumed into the stale pre-error aggregate. A public proof-of-concept test is included in the GHSA advisory; fixed in Netty 4.1.136.Final and 4.2.16.Final with no KEV listing at time of analysis.

Certificate revocation-check bypass in the Netty network framework's OCSP client (io.netty:netty-handler-ssl-ocsp) affects versions 4.2.0.Final through 4.2.15.Final and all releases prior to 4.1.136.Final, where OcspClient.validateResponse never confirms that the CertificateID in an OCSP response matches the certificate being validated. An attacker holding any valid, non-revoked certificate from the same issuing CA can obtain a legitimately signed GOOD response and replay it to make Netty accept a revoked or compromised certificate as valid. Publicly available exploit code exists (a PoC test case in the GHSA advisory), but there is no public exploit identified as being used in active attacks and EPSS risk is low (0.30%, 22nd percentile).

Denial of service in the Netty network framework (4.2.0.Final-4.2.15.Final and 4.1.0.Final-4.1.135.Final) lets a remote unauthenticated peer exhaust JVM direct memory and crash the process. Applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener leak one direct ByteBuf for every HTTP/2 DATA frame delivered to a stream whose decompressor has already been closed, because Http2Decompressor.decompress(...) retains the buffer for writeInbound but never releases it on the error path. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

XML external entity exposure in the Netty network framework affects the optional XmlDecoder handler in versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, where the underlying Aalto AsyncXMLInputFactory is instantiated without any security hardening. Any remote party able to push bytes into a channel pipeline that contains XmlDecoder can submit XML carrying a DOCTYPE/DTD declaration, and depending on Aalto async parser behavior DTD and entity processing remains active, creating a conditional path to reading local files or performing SSRF-style out-of-band requests. There is no public exploit identified at time of analysis, the issue is not on CISA KEV, and it is fixed in 4.1.136.Final and 4.2.16.Final.

Memory-exhaustion denial of service in Netty's HTTP/3 codec (Http3FrameCodec) affects all releases prior to 4.2.16.Final, where decodeFrame trusts the wire-supplied payLoadLength and buffers reserved-frame-type payloads without an upper bound. A remote unauthenticated attacker (CVSS 7.5, AV:N/PR:N) can open many QUIC streams and advertise very large payload lengths on reserved HTTP/3 frames to force unbounded heap allocation and crash the server. No public exploit or CISA KEV listing exists at time of analysis; a vendor patch (4.2.16.Final) is available.

Cross-origin resource sharing controls in Netty's CorsHandler can be entirely bypassed by sending an `Origin: null` header, due to a logical operator error in the origin evaluation path. Affected are Netty 4.1.0.Final through 4.1.135.Final and 4.2.0.Final through 4.2.15.Final - a range spanning years of releases across both major active branches. An unauthenticated remote attacker who can induce a victim to initiate a cross-origin request can bypass the `shortCircuit()` enforcement entirely, causing unauthorized requests to be forwarded to the backend application as if they were permitted. No public exploit or KEV listing is identified at time of analysis, but the bypass mechanism is straightforward and vendor-confirmed.

Uncontrolled native-memory consumption in Netty's SPDY-to-HTTP codec (SpdyHttpDecoder) lets a remote unauthenticated peer exhaust off-heap memory and crash the server. Affected versions are 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final; the decoder allocates a pooled ByteBuf for an in-flight SYN_STREAM request but fails to release it when the stream is aborted via RST_STREAM or when content exceeds maxContentLength. There is no public exploit identified at time of analysis, and this CVE is not listed in CISA KEV; impact is denial of service only (VC:N/VI:N/VA:H).

Remote denial of service in the Netty networking framework (codec-haproxy module) versions 4.1.0.Final through 4.1.135 and 4.2.0.Final through 4.2.15.Final lets unauthenticated attackers exhaust JVM direct memory. The HAProxyMessageDecoder mis-parses a PROXY protocol v2 header whose version byte is 0xFF, sign-extending it to -1, which collides with the decoder's 'need more data' sentinel, so ByteToMessageDecoder accumulates inbound bytes in an unbounded cumulation buffer until the process runs out of direct memory. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.7 reflects high availability impact with no confidentiality or integrity effect.

Compression-amplification denial of service in the Netty network framework (versions prior to 4.1.136.Final and 4.2.16.Final) allows a remote peer to send a small zlib-compressed SPDY HEADERS block that Netty keeps inflating even after the raw header parser exceeds maxHeaderSize and marks the frame truncated in SpdyFrameCodec. The result is disproportionate CPU consumption and allocation churn (CWE-400) from a tiny input, degrading or crashing services that expose the SPDY codec. No public exploit identified at time of analysis and it is not listed in CISA KEV; impact is availability-only per CVSS 7.5 (A:H).

Memory-amplification denial of service in the Netty network framework (SPDY/3.1 codec) prior to 4.1.136.Final and 4.2.16.Final allows a remote unauthenticated peer to send a single ~2 MiB SPDY SETTINGS frame that forces the server to materialize 262,144 map entries in DefaultSpdySettingsFrame, driving heap growth and ordered-map insertion CPU cost far out of proportion to the input. Affected are Java services that enable Netty's SPDY handler and accept untrusted connections; there is no public exploit identified at time of analysis, and while CVSS is 7.5 the low EPSS-style real-world footprint is tempered by SPDY/3.1 being a deprecated, rarely-enabled protocol.

Netty's HTTP/2 codec mishandles the SETTINGS_MAX_HEADER_LIST_SIZE client setting, enabling a denial-of-service attack functionally equivalent to HTTP/2 Rapid Reset (CVE-2023-44487) but with a distinct on-wire signature. Affected Netty versions prior to 4.1.135.Final and 4.2.15.Final fully process and proxy incoming requests to the origin before encountering an exception during response header serialization, consuming server resources without completing responses. No public exploit has been identified at time of analysis, and EPSS stands at 0.02% (5th percentile), though the attack technique parallels a well-documented catastrophic DDoS class.

HTTP request smuggling in Netty's HttpObjectDecoder (netty-codec-http) allows unauthenticated remote attackers to manipulate request-boundary parsing in pipelined or multiplexed deployments by injecting non-CRLF ISO control characters (NUL, SOH, STX, etc.) before the HTTP request-line. Affected are all Netty releases prior to 4.1.135.Final and 4.2.15.Final; both branches have vendor-confirmed patches. No public exploit code has been identified and EPSS is 0.04% (12th percentile), indicating low current exploitation likelihood, though the attack surface expands significantly in architectures fronted by proxies or load balancers that strip or interpret those control bytes differently than Netty does.

Denial of service in Netty's io.netty:netty-codec-redis component (prior to 4.1.135.Final and 4.2.15.Final) allows remote attackers to trigger memory exhaustion by sending a crafted RESP array header that declares a huge element count, causing RedisArrayAggregator to pre-allocate an oversized ArrayList before any child messages arrive. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided in the input.

TLS hostname verification is silently disabled in Netty's netty-handler module for any client built with SslContextBuilder.forClient().trustManager(somePlainX509TrustManager), allowing network attackers in a man-in-the-middle position to present a valid certificate for any host and intercept supposedly encrypted traffic. Affects all Netty versions prior to 4.1.135.Final and 4.2.15.Final; no public exploit identified at time of analysis and EPSS is very low (0.04%), but the defect bypasses a core TLS protection that Netty 4.2 explicitly advertises as enabled by default.

Stateless reset token leakage in Netty's QUIC codec (io.netty:netty-codec-classes-quic prior to 4.2.15.Final) enables an on-path attacker to derive the reset token for active connections and terminate them via spoofed Stateless Reset packets. The default HMAC-based generators expose a deterministic relationship between the source connection ID visible in QUIC headers and the server's stateless reset token - after a source-CID rotation, an observer can compute the token from the new connection-ID bytes. No public exploit identified at time of analysis; the CVSS 4.8 Medium rating reflects the on-path attacker prerequisite (AC:H), which meaningfully limits opportunistic exploitation.

Denial of service in the Netty HTTP/3 codec (io.netty:netty-codec-http3) prior to version 4.2.15.Final allows remote unauthenticated attackers to exhaust server memory by triggering creation of an unbounded number of blocked streams, leading to an OutOfMemoryError. The flaw affects any Java application or service using Netty as an HTTP/3 server. No public exploit identified at time of analysis, and EPSS probability is very low (0.05%, 17th percentile), but the network-reachable nature of the HTTP/3 protocol surface makes patching a priority for exposed endpoints.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. Rated low severity (CVSS 2.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Netty is an asynchronous, event-driven network application framework. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resources by rapidly opening and immediately canceling (RST_STREAM) large numbers of streams over a single connection, a technique dubbed the 'Rapid Reset' attack. The flaw is confirmed actively exploited (CISA KEV) following large-scale weaponization observed August through October 2023, with publicly available exploit code and an EPSS score of 94.45% placing it in the 100th percentile for likelihood of exploitation. Virtually every major HTTP/2 stack - including nghttp2, Netty, Envoy, and Eclipse Jetty - is affected.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Netty project is an event-driven asynchronous network application framework. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Netty project is an event-driven asynchronous network application framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Netty is an open-source, asynchronous event-driven network application framework. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.