An open index of dependabot pull requests across open source projects.

io.netty:netty-codec-http2

Ecosystem:
maven
Package URL:
pkg:maven/io.netty:netty-codec-http2
Total PRs:
222 Dependabot PRs
Latest PR:
10 days ago
Unique Repositories:
90 repositories
Unique Repos (30 days):
8 repositories
Security Advisories
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
GHSA-563q-j3cm-6jxm CVE-2026-50560 MODERATE published 3 days ago • updated 3 days ago
### Summary Netty HTTP/2 max header size handling produces attack similar to HTTP/2 Rapid Reset. ### Details There is a setting in the http2 spe...
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
GHSA-f6hv-jmp6-3vwv CVE-2026-42587 HIGH published about 1 month ago • updated 2 days ago
## Summary `HttpContentDecompressor` accepts a `maxAllocation` parameter to limit decompression buffer size and prevent decompression bomb attacks...
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
GHSA-w9fj-cfpg-grvv CVE-2026-33871 HIGH published 3 months ago • updated 15 days ago
### Summary A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The serv...
Possible request smuggling in HTTP/2 due missing validation of content-length
GHSA-f256-j965-7f32 CVE-2021-21409 MODERATE published about 5 years ago • updated 9 days ago
### Impact The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true...
Netty affected by MadeYouReset HTTP/2 DDoS vulnerability
GHSA-prj3-ccx8-p6x4 CVE-2025-55163 HIGH published 10 months ago • updated about 17 hours ago
Below is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.” ### MadeYouReset Vulnerabilit...
Recent PRs
Bump the maven group across 8 directories with 10 updates

vicaya/pulsar #9

4.1.32.Final → 4.1.133.Final Patch PR
Closed about 1 month ago 1 comment
vicaya
Bump the dependencies group with 3 updates

Olsc/DroidGit #19

4.2.10.Final → 4.2.11.Final Patch PR
Open 3 months ago 1 comment
Olsc
Bump the netty group with 11 updates

IBM/ibm-cos-sdk-java-v2 #39

4.2.9.Final → 4.2.10.Final Patch PR
Closed 3 months ago 1 comment
IBM
Package Details
Name: io.netty:netty-codec-http2
Ecosystem: maven
PURL Type: maven
Package URL: pkg:maven/io.netty:netty-codec-http2
JSON API: View JSON
Security Advisories

9

Active advisories
HIGH 4
MODERATE 5
View All maven Advisories
Package Information
Description:

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers and clients.

Repository: https://github.com/netty/netty
Homepage: http://netty.io/
Latest Release: 4.2.2.Final
about 1 year ago
Dependent Repos: 1,457
Dependent Packages: 556
Ranking: Top 0.3036% by dependent repos Top 0.1773% by dependent pkgs
PR Status
Open 103 (46.4%)
Merged 31 (14.0%)
Closed 81 (36.5%)
PR Types
Major 1 (0.5%)
Minor 47 (21.2%)
Patch 167 (75.2%)