Critical
CVE-2026-75595
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 92
Reset filters
Medium
CVE-2026-75596
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
Medium
CVE-2026-59903
Netty Vulnerable to Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
High
CVE-2026-59902
Netty: Memory Exhaustion in SctpMessageCompletionHandler
Medium
CVE-2026-56818
Netty: RedisArrayAggregator max-elements failure leaves retained partial aggregate state
High
CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
High
CVE-2026-73507
Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
Medium
CVE-2026-73508
Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
Medium
CVE-2026-59921
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
Medium
CVE-2026-59920
Netty: STOMP CONNECT Frame Header Injection in Netty
Medium
CVE-2026-59919
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
High
CVE-2026-59901
Netty: [Bzip2Decoder] Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
Medium
CVE-2026-59900
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
Medium
CVE-2026-59899
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
Medium
CVE-2026-59898
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
High
CVE-2026-56822
Netty: TOCTOU in OcspServerCertificateValidator
High
CVE-2026-56821
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
High
CVE-2026-56820
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
High
CVE-2026-56817
Netty XML: Injection / Risky Sink — unconfigured XML factory with active DTD and entity handling
High
CVE-2026-56816
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
Medium
CVE-2026-56746
Netty: Security Control Bypass via CORS Short-Circuit Failure
High
CVE-2026-56745
Netty: [SpdyHttpDecoder] ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
High
CVE-2026-55851
Netty: [codec-haproxy] Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
High
CVE-2026-55833
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.