What’s Vulnerable › Products

netty-incubator-codec-ohttp vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your netty-incubator-codec-ohttp version is affected

Latest netty-incubator-codec-ohttp vulnerabilities

• CVE-2026-54251 — netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service (CVSS 8.7)
• CVE-2026-48480 — netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation (CVSS 6.6)
• CVE-2026-48040 — netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access (CVSS 9.1)
• CVE-2026-41207 — netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures (CVSS 5.3)
• CVE-2024-40642 — Absent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp (CVSS 8.1)
• CVE-2024-36121 — netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces (CVSS 9.1)