Io.netty:netty-codec-http

This hub aggregates every CVE we track for Io.netty:netty-codec-http, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 8 most recently published vulnerabilities affecting Io.netty:netty-codec-http.

• CVE-2025-67735Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder6.5Dec 16, 2025
• CVE-2025-58056Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions7.5Sep 3, 2025
• CVE-2024-29025Netty HttpPostRequestDecoder can OOM5.3Mar 25, 2024
• CVE-2022-41915Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultHttpHeadesr.set` with an _iterator_ of ...6.5Dec 13, 2022
• CVE-2022-24823Local Information Disclosure Vulnerability in io.netty:netty-codec-http5.5May 6, 2022
• CVE-2021-43797HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling6.5Dec 9, 2021
• CVE-2021-21290Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files6.2Feb 8, 2021
• CVE-2019-20444HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "inva...9.1Jan 29, 2020