N
Vendor security profile
netty
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs74
Critical6
CISA KEV0
Public exploit26
Patch rate%50
Avg. CVSS7.4
12-month vulnerability rate
0
0
0
0
2
0
7
17
19
10
10
0
CVE KEV
CVE severity distribution
74toplam CVE
Critical6 (8%)
High46 (62%)
Medium20 (27%)
Low2 (3%)
Patch and exploitation view
%50
Verified patch
%0
CISA KEV
%35
Public exploit
37Patch available
0Partial
0Workaround
0Vendor: no patch
37Unknown
Latest vulnerabilities
6.9
CVE-2026-100666
Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
N
Patch status unknownEPSS %0
8.7
CVE-2026-100665
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
N
Patch verifiedEPSS %0
8.7
CVE-2026-100664
Netty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion
N
Patch status unknownEPSS %0
8.7
CVE-2026-100663
Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3
N
Patch status unknownEPSS %0
8.7
CVE-2026-100662
Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS
N
Patch status unknownEPSS %0
8.7
CVE-2026-100661
Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation
N
Patch status unknownEPSS %0
8.7
CVE-2026-100660
Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention
N
Patch status unknownEPSS %0
6.9
CVE-2026-100659
Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass
N
Patch status unknownEPSS %0
8.7
CVE-2026-54251
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
N
Patch verifiedEPSS %1
6.9
CVE-2026-89044
Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding
N
Patch verifiedEPSS %0