`io.netty:netty-codec-http`

Ecosystem:
maven

Package URL:
pkg:maven/io.netty:netty-codec-http

Total PRs:
301 Dependabot PRs

Latest PR:
24 days ago

Unique Repositories:
164 repositories

Unique Repos (30 days):
6 repositories

Security Advisories

Netty: Security Control Bypass via CORS Short-Circuit Failure

GHSA-6cqp-g7gg-8hr5 CVE-2026-56746 MODERATE published 1 day ago • updated 1 day ago

### Summary Netty's CorsHandler provides a `shortCircuit()` configuration designed to reject unauthorized cross-origin requests immediately, acting...

Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion

GHSA-jppx-w49h-x2qq CVE-2026-56745 HIGH published 1 day ago • updated 1 day ago

The `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with...

HTTP request smuggling in netty

GHSA-wx5j-54mm-rqqq CVE-2021-43797 MODERATE published over 4 years ago • updated 14 days ago

### Impact Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast a...

Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder

GHSA-gcjf-9mgh-3p7g CVE-2026-59921 MODERATE published 1 day ago • updated 1 day ago

# Security Vulnerability Report: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder ## 1. Vulnerability Summary | Field | Valu...

Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

GHSA-q4f6-jm68-57ww CVE-2026-59899 MODERATE published 1 day ago • updated 1 day ago

### Impact `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence...

View all 22 advisories

Recent PRs

RSS Feed

chore(deps): bump the all-dependencies group across 15 directories with 49 updates

walt-id/waltid-identity #1825

4.1.135.Final → 4.2.15.Final Minor PR

Open 24 days ago 1 comment

chore(deps): bump the all-backend-non-major-dependencies group across 1 directory with 13 updates

digitalservicebund/ris-norms #2335

4.2.13.Final → 4.2.15.Final Patch PR

Closed about 1 month ago 1 comment

Bump the bpm-minor-patch group across 1 directory with 29 updates

AOT-Technologies/forms-flow-ai #3317

4.1.125.Final → 4.2.15.Final Minor PR

Open about 2 months ago 2 comments

Bump the all-dependencies group across 1 directory with 8 updates

navikt/kabin-api #450

4.2.14.Final → 4.2.15.Final Patch PR

Closed about 2 months ago 1 comment

build(deps): Bump the maven-dependencies group across 1 directory with 6 updates

onyxsellmoore/resale_tracker #17

4.1.132.Final → 4.2.14.Final Minor PR

Open about 2 months ago 1 comment

build(deps): bump the gradle-dependencies group across 1 directory with 33 updates

sahilsaraearth-svg/aro-music #6

4.2.13.Final → 4.2.14.Final Patch PR

Closed about 2 months ago 1 comment

chore(deps): bump the all-backend-non-major-dependencies group across 1 directory with 8 updates

digitalservicebund/ris-norms #2327

4.2.13.Final → 4.2.14.Final Patch PR

Closed about 2 months ago 1 comment

Bump the gradle group across 0 directory with 2 updates

MihaiCristianCondrea/App-Toolkit-for-Android #671

4.1.132.Final → 4.2.14.Final Minor PR

Closed 2 months ago 1 comment

chore(deps): bump the maven group across 1 directory with 2 updates

eclipse-ecsp/api-gateway #255

4.2.11.Final → 4.2.13.Final Patch PR

Closed 3 months ago 1 comment

chore(deps): bump the gradle-dependencies group across 1 directory with 8 updates

AndroidIRCx/NULVEX #53

4.2.12.Final → 4.2.13.Final Patch PR

Closed 3 months ago 1 comment

deps(deps-dev): Bump io.netty:netty-codec-http from 4.1.130.Final to 4.1.133.Final

montge/ddf #207

4.1.130.Final → 4.1.133.Final Patch PR

Closed 3 months ago 7 comments

Bump io.netty:netty-codec-http from 4.2.12.Final to 4.2.13.Final in the gradle group across 1 directory

fam007e/extensions-source #1

4.2.12.Final → 4.2.13.Final Patch PR

Closed 3 months ago 1 comment

Bump io.netty:netty-codec-http from 4.1.132.Final to 4.1.133.Final

nextflow-io/nextflow #7101

4.1.132.Final → 4.1.133.Final Patch PR

Open 3 months ago 1 comment

build(deps): bump io.netty:netty-codec-http from 4.1.89.Final to 4.1.132.Final

mock-server/mockserver #1983

4.1.89.Final → 4.1.132.Final Patch PR

Closed 3 months ago 2 comments

Bump the minor-and-patch-dependencies group across 1 directory with 5 updates

scalar-labs/scalardb #3491

4.1.132.Final → 4.2.12.Final Minor PR

Open 3 months ago 5 comments

Bump the minor-and-patch-dependencies group with 3 updates

scalar-labs/scalardb #3489

4.1.132.Final → 4.2.12.Final Minor PR

Closed 3 months ago 7 comments

Bump io.netty:netty-codec-http from 4.1.129.Final to 4.1.132.Final in /gxqueue-awssqs

genexuslabs/JavaClasses #1095

4.1.129.Final → 4.1.132.Final Patch PR

Closed 4 months ago 2 comments

[DT-400-maven]: Bump the maven-other-updates group with 9 updates

DataBiosphere/consent #2846

4.2.10.Final → 4.2.12.Final Patch PR

Closed 4 months ago 5 comments

Bump io.netty:netty-codec-http from 4.2.8.Final to 4.2.10.Final

awslabs/amazon-kinesis-client-nodejs #466

4.2.8.Final → 4.2.10.Final Patch PR

Closed 4 months ago 2 comments

Bump the maven group across 4 directories with 2 updates

khulnasoft/BenchWeb #60

4.1.108.Final → 4.1.132.Final Patch PR

Closed 4 months ago 1 comment

Bump the maven group across 2 directories with 3 updates

idgrou/sakai #9

4.1.112.Final → 4.1.132.Final Patch PR

Closed 4 months ago 2 comments

chore(deps): bump the maven group across 6 directories with 2 updates

Talend/component-runtime #1186

4.1.119.Final → 4.1.132.Final Patch PR

Closed 4 months ago 1 comment

Bump the maven group across 4 directories with 2 updates

Hawthorne001/azure-sdk-for-java #539

4.1.130.Final → 4.1.132.Final Patch PR

Open 4 months ago 1 comment

deps(deps-dev): Bump io.netty:netty-codec-http from 4.1.130.Final to 4.1.132.Final

montge/ddf #195

4.1.130.Final → 4.1.132.Final Patch PR

Open 4 months ago 4 comments

Bump io.netty:netty-codec-http from 4.1.130.Final to 4.1.132.Final in /generated-platform-project/quarkus/bom

quarkusio/quarkus-platform #1840

4.1.130.Final → 4.1.132.Final Patch PR

Open 4 months ago 1 comment

Bump the maven group across 29 directories with 6 updates

preechapon250/azure-sdk-for-java #9

4.1.130.Final → 4.1.132.Final Patch PR

Closed 4 months ago 1 comment

Bump the maven group across 4 directories with 5 updates

davidanderson01/netty #2

4.2.1.Final-SNAPSHOT → 4.2.5.Final Patch PR

Closed 4 months ago 1 comment

build(deps): bump io.netty:netty-codec-http from 4.2.9.Final to 4.2.11.Final

reformcloudapp/reformcloud #75

4.2.9.Final → 4.2.11.Final Patch PR

Open 4 months ago 1 comment

Bump the dependencies group across 1 directory with 6 updates

shieldblaze/ExpressGateway #199

4.2.10.Final → 4.2.11.Final Patch PR

Closed 4 months ago 1 comment

Bump the netty group with 11 updates

IBM/ibm-cos-sdk-java-v2 #39

4.2.9.Final → 4.2.10.Final Patch PR

Closed 4 months ago 1 comment

Bump the bpm-minor-patch group in /forms-flow-bpm with 30 updates

AOT-Technologies/forms-flow-ai #3206

4.1.125.Final → 4.2.10.Final Minor PR

Open 4 months ago 3 comments

Bump the maven group across 17 directories with 10 updates

khulnasoft/BenchWeb #45

4.1.108.Final → 4.1.129.Final Patch PR

Closed 5 months ago 1 comment

chore(deps): bump the low-risk group across 1 directory with 24 updates

Ensono/stacks-java-cqrs #825

4.2.8.Final → 4.2.10.Final Patch PR

Open 5 months ago 2 comments

chore(deps): bump the maven group across 4 directories with 2 updates

Talend/component-runtime #1170

4.1.119.Final → 4.1.129.Final Patch PR

Closed 5 months ago 1 comment

Bump io.netty:netty-codec-http from 4.1.48.Final to 4.1.129.Final in the gradle group across 1 directory

entur/android-nfc-lib #69

4.1.48.Final → 4.1.129.Final Patch PR

Closed 5 months ago 1 comment

Bump the gradle-updates group across 1 directory with 14 updates

ministryofjustice/laa-amend-a-claim #234

4.2.9.Final → 4.2.10.Final Patch PR

Closed 5 months ago 1 comment

Bump io.netty:netty-codec-http from 4.2.9.Final to 4.2.10.Final

tim-littlefair/maneline #104

4.2.9.Final → 4.2.10.Final Patch PR

Closed 5 months ago 1 comment

Bump io.netty:netty-codec-http from 4.1.128.Final to 4.1.129.Final in /shims/cdpdc71/driver

pentaho/pentaho-hadoop-shims #1770

4.1.128.Final → 4.1.129.Final Patch PR

Open 5 months ago 3 comments

chore(deps): bump the low-risk group with 9 updates

Ensono/stacks-java-module-parent #346

4.2.9.Final → 4.2.10.Final Patch PR

Open 5 months ago 6 comments

build(deps): bump the low-risk group across 1 directory with 25 updates

Ensono/stacks-java #1545

4.2.8.Final → 4.2.9.Final Patch PR

Closed 6 months ago 1 comment

build(deps): bump io.netty:netty-codec-http from 4.1.108.Final to 4.2.9.Final

millenniumsingha/Safelink #82

4.1.108.Final → 4.2.9.Final Minor PR

Closed 6 months ago 2 comments

Bump the maven group across 15 directories with 5 updates

qenex-ai/azure-sdk-for-java #922

4.1.127.Final → 4.1.129.Final Patch PR

Closed 6 months ago 1 comment

chore(deps): bump the low-risk group across 1 directory with 24 updates

Ensono/stacks-java-cqrs #807

4.2.8.Final → 4.2.9.Final Patch PR

Open 6 months ago 7 comments

build(deps): bump the low-risk group across 1 directory with 23 updates

Ensono/stacks-java #1540

4.2.8.Final → 4.2.9.Final Patch PR

Closed 6 months ago 3 comments

Bump io.netty:netty-codec-http from 4.1.118.Final to 4.1.129.Final

AuraFrameFxDev/AuraFrameFx #164

4.1.118.Final → 4.1.129.Final Patch PR

Closed 7 months ago 2 comments

Bump the third-party group across 1 directory with 16 updates

openziti/ziti-sdk-jvm #745

4.2.7.Final → 4.2.9.Final Patch PR

Closed 7 months ago 1 comment

chore(deps): bump the low-risk group with 7 updates

Ensono/stacks-java-module-parent #336

4.2.8.Final → 4.2.9.Final Patch PR

Closed 7 months ago 1 comment

build(deps): bump the low-risk group across 1 directory with 22 updates

Ensono/stacks-java #1537

4.2.5.Final → 4.2.9.Final Patch PR

Open 7 months ago 3 comments

Bump the all-backend-non-major-dependencies group across 1 directory with 5 updates

digitalservicebund/ris-backend-service #3604

4.1.129.Final → 4.2.9.Final Minor PR

Closed 7 months ago 1 comment

Bump the all-backend-non-major-dependencies group in /backend with 5 updates

digitalservicebund/ris-backend-service #3598

4.1.129.Final → 4.2.8.Final Minor PR

Closed 7 months ago 1 comment

Package Details

Name:	`io.netty:netty-codec-http`
Ecosystem:	maven
PURL Type:	maven
Package URL:	`pkg:maven/io.netty:netty-codec-http`
JSON API:	View JSON

Security Advisories

22

Active advisories

HIGH 6

MODERATE 15

LOW 1

View All maven Advisories

Package Information

Description:

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.

Repository:	https://github.com/netty/netty
Homepage:	http://netty.io/
Latest Release:	`4.2.2.Final` about 1 year ago
Dependent Repos:	6,505
Dependent Packages:	1,324
Ranking:	Top 0.1092% by dependent repos Top 0.0609% by dependent pkgs

PR Status

Open 145 (48.2%)

Merged 35 (11.6%)

Closed 114 (37.9%)

PR Types

Minor 46 (15.3%)

Patch 248 (82.4%)