Medium
CVE-2026-59903
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 38
Reset filters
High
CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
Medium
CVE-2026-59921
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
Medium
CVE-2026-59900
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
Medium
CVE-2026-59899
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
Medium
CVE-2026-59898
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
High
CVE-2026-56816
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
Medium
CVE-2026-56746
Netty: Security Control Bypass via CORS Short-Circuit Failure
High
CVE-2026-56745
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
High
CVE-2026-55833
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
High
CVE-2026-55831
Netty SPDY SETTINGS frame count materializes unbounded settings map
Medium
CVE-2026-50560
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
Medium
CVE-2026-50020
Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted
High
CVE-2026-48748
Netty HTTP/3 QPACK Blocked Streams Memory Exhaustion
Medium
CVE-2026-48043
netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion
Medium
CVE-2026-47244
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
High
CVE-2026-44892
Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
High
CVE-2026-42587
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
Medium
CVE-2026-42585
Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding
High
CVE-2026-42584
Netty has HttpClientCodec response desynchronization
High
CVE-2026-42582
Netty HTTP/3 QPACK literal unbounded allocation
Medium
CVE-2026-42581
Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
Medium
CVE-2026-42580
Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing
Medium
CVE-2026-41417
Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.