- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 13
- Public CVEs
- 78
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
13 assets you may test, 6 excluded.
Web 1
- https://netty.io
Products and areas 12
- Every other protocol codec shipped in the tree, including Redis, MQTT, STOMP, HAProxy protocol, SPDY, memcached, SMTP and the socks and haproxy proxy handlers
- Native transports, epoll, kqueue and io_uring, and their JNI boundaries
- The buffer allocator and the reference-counting model, where a leak or a double release is a memory-safety issue even on the JVM
- The channel pipeline, event loops and handler lifecycle, including exception propagation and what happens to a connection when a handler throws
- The codec-base machinery: cumulation, frame decoders and every place a length prefix from the wire drives an allocation
- The DNS codec and resolver: transaction ID generation, response matching, bailiwick checks and cache behaviour
- The HTTP/1.1 codec: request and response decoding, header validation, chunked handling, and the reconciliation of Content-Length against Transfer-Encoding
- The HTTP/2 codec: frame handling, HPACK, stream state, flow control and the HTTP/1-to-HTTP/2 translation layer downstream frameworks depend on
- The HTTP/3 and QUIC codecs, including QPACK encoding and decoding and the state each connection holds
- The security policy takes reports through GitHub private vulnerability reporting under a ninety-day disclosure window and draws no boundary narrower than the Netty tree, so every codec and every transport in the repository is in bounds
- The SSL and TLS layer in full, covering the JDK and OpenSSL-backed engines, certificate and hostname verification, and OCSP stapling validation
- The WebSocket implementation from handshake through frame decoding, extension negotiation and continuation handling
Out of scope (6)
- Branches the project no longer maintains
- Denial of service proportional to connection count with no amplification factor
- Downstream frameworks including Spark, Elasticsearch and Spring WebFlux as products, unless the defect is in Netty's own code
- Findings already covered by one of the published 2026 advisory batches
- JDK and OpenSSL defects that reach Netty as a dependency
- Pipelines a downstream project assembled unsafely out of components that behave correctly on their own
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report through GitHub private vulnerability reporting on netty/netty . The security policy names that channel and a ninety-day disclosure window
-
Name the codec. Netty ships HTTP/1, HTTP/2, HTTP/3, DNS, Redis, MQTT, STOMP, HAProxy protocol and SPDY codecs, and a finding in one says nothing about the others
-
Say whether the defect is in the codec itself or in how a pipeline assembles handlers, because almost every downstream project builds its own pipeline
-
Include a failing test at the codec level as well as an end-to-end reproduction. Netty is a library, so the pipeline configuration is part of the repro
-
State the branch. 4.1 and 4.2 are both in the field and downstream projects are spread across them
Not accepted
-
Denial of service proportional to connection count with no amplification factor
-
Findings already covered by one of the published 2026 advisory batches
-
JDK and OpenSSL defects that reach Netty as a dependency
-
Pipelines a downstream project assembled unsafely out of components that behave correctly on their own
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-89044 | Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messag | Medium 6.9 | 10 Sep 2026 |
| CVE-2026-62380 | Netty (io.netty:netty-codec-socks) versions 4.2.0.Final through 4.2.16.Final and 4.1.x through 4.1.136.Final contain null byte, CRLF, and credential injection vulnerabilities in the SOCKS4 (Socks4ClientEncoder) and SOCKS5 (Socks5ClientEncoder) client encoders, which fail to validate domain address and authentication (username/password) fields. An attacker able to control these fields can inject nu | Medium 6.3 | 22 Aug 2026 |
| CVE-2026-75595 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandler#decode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause an IndexOutOfBoundsException and invoke select(ctx, null). This selects the default SslContext instea | Critical 9.1 | 19 Aug 2026 |
| CVE-2026-75596 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler constructors use the pre-handshake ClientHello aggregation path in handler/src/main/java/io/netty/handler/ssl/SslClientHelloHandler.java at io.netty.handler.ssl.SslClientHelloHandler#decode, where handshakeBuffer.clear() and writeBytes() recopy | High 8.7 | 19 Aug 2026 |
| CVE-2026-59902 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final. | High 7.5 | 17 Aug 2026 |
| CVE-2026-59903 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary headers such as Authorization or Cookie with Origin, allowing a caching proxy or CDN to reuse authenticated responses across users and disclose sensitive information. This issue is fixed in versions 4.1.1 | Medium 6.5 | 17 Aug 2026 |
| CVE-2026-73507 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, caus | High 7.5 | 13 Aug 2026 |
| CVE-2026-73508 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.dns.AbstractDnsRecord, io.netty.handler.codec.dns.DefaultDnsRecordDecoder.decodeRecord(), and io.netty.handler.codec.dns.DnsCodecUtil.decompressDomainName() failed to release retained or newly allocated ByteBuf objects when IDN.toASCII() or encodeDomainName() reject | Medium 5.3 | 13 Aug 2026 |
| CVE-2026-56818 | Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, the RedisArrayAggregator Redis codec clears retained partial aggregate state when the maxNestedArrayDepth limit is exceeded, but it does not clear the same state when the sibling maxElements limit is exceeded. A peer can start a valid RESP array, send a bulk string child, then send a nest | Medium 6.5 | 7 Aug 2026 |
| CVE-2026-59898 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HT | Medium 6.3 | 29 Jul 2026 |
| CVE-2026-59919 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1 text protocol without validating them for CRLF characters, so an attacker who controls an AF_UNIX address can inject \r\n sequences and split the single | Medium 5.5 | 29 Jul 2026 |
| CVE-2026-59920 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in CONNECT and CONNECTED frames, so raw newline ( \n ) characters in a header value are written directly to the wire, allowing an attacker who controls a header value to inject additional | Medium 6.5 | 29 Jul 2026 |
| CVE-2026-59899 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every | Medium 6.9 | 29 Jul 2026 |
| CVE-2026-59900 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS fr | Medium 6.9 | 29 Jul 2026 |
| CVE-2026-59901 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machi | High 8.7 | 29 Jul 2026 |
| CVE-2026-56821 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitatio | High 7.4 | 29 Jul 2026 |
| CVE-2026-56822 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator forwards the SslHandshakeCompletionEvent before the asynchronous OCSP validation completes. This allows the client's downstream handlers to send sensitive application data (e.g., HTTP requests) to a revoked server before the channel is closed by | High 7.4 | 29 Jul 2026 |
| CVE-2026-59921 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker w | Medium 5.7 | 28 Jul 2026 |
| CVE-2026-56817 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity h | High 8.3 | 21 Jul 2026 |
| CVE-2026-56819 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a str | High 7.5 | 21 Jul 2026 |
| CVE-2026-56820 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an | High 7.4 | 21 Jul 2026 |
| CVE-2026-56745 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messag | High 8.7 | 21 Jul 2026 |
| CVE-2026-56746 | Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control b | Medium 6.5 | 21 Jul 2026 |
| CVE-2026-56816 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.2.16.Final, Netty's `Http3FrameCodec` buffers incoming data for HTTP/3 reserved frame types up to the wire-specified payload length without limits; `decodeFrame` trusts `payLoadLength`, allowing an attacker to open multiple QUIC streams and send reserved frames with very large payload lengths to ca | High 7.5 | 21 Jul 2026 |
| CVE-2026-55851 | Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROX | High 8.7 | 21 Jul 2026 |
| CVE-2026-55833 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty SPDY header decoding continues inflating zlib-compressed header blocks after the raw header parser has exceeded `maxHeaderSize` and marked the frame truncated in `SpdyFrameCodec`, allowing a remote peer to send a small compressed `HEADERS` block that expands into | High 7.5 | 21 Jul 2026 |
| CVE-2026-55831 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS f | High 7.5 | 21 Jul 2026 |
| CVE-2026-44891 | Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumu | High 7.5 | 17 Jul 2026 |
| CVE-2026-50560 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty HTTP/2 max header size handling produces an attack similar to HTTP/2 Rapid Reset. There is a setting in the http2 specification called `SETTINGS_MAX_HEADER_LIST_SIZE`. When a client sends that setting to Netty, it appears that Netty will behave as follow | Medium 6.9 | 12 Jun 2026 |
| CVE-2026-48043 | Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped | Medium 5.3 | 12 Jun 2026 |
| CVE-2026-48059 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the HAProxy PROXY protocol v2 codec in netty leaks native or heap memory on every connection when a client sends a syntactically valid header containing nested `PP2_TYPE_SSL` TLVs (type-length-value records) at depth two or greater. The leak occurs on the succ | High 8.7 | 12 Jun 2026 |
| CVE-2026-48748 | Netty is a network application framework for development of protocol servers and clients. Starting in version 4.2.0.Final and prior to version 4.2.15.Final, a memory exhaustion vulnerability in the Netty HTTP/3 codec allows the creation of an infinite number of blocked streams, which can cause OOM error. Version 4.2.15.Final patches the issue. | High 7.5 | 12 Jun 2026 |
| CVE-2026-50009 | Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connection-ID and stateless-reset-token generators. The reset token for the server's current source connection ID can be derived from bytes that appear as the connection ID in QUIC | Medium 4.8 | 12 Jun 2026 |
| CVE-2026-50010 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by dis | High 7.5 | 12 Jun 2026 |
| CVE-2026-50011 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, RedisArrayAggregator pre-allocates ArrayList with initial capacity equal to the RESP array element count declared in an array header. That count is taken from the wire before the corresponding child messages exist. A small malicious header can claim a huge ini | High 7.5 | 12 Jun 2026 |
| CVE-2026-50020 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, `HttpObjectDecoder` skips every byte for which `Character.isISOControl(b)` is `true` (0x00–0x1F and 0x7F) as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — | Medium 5.3 | 12 Jun 2026 |
| CVE-2026-47691 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver. | High 8.7 | 12 Jun 2026 |
| CVE-2026-48006 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, the RedisArrayAggregator handler permanently leaks pooled direct-memory buffers when a Redis pipeline connection closes before a RESP array aggregate completes. The handler retains child messages in per-handler state (`depths` field) but defines no `channelIna | High 8.7 | 12 Jun 2026 |
| CVE-2026-47244 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, DefaultHttp2Connection.DefaultEndpoint initialises maxActiveStreams/maxStreams to Integer.MAX_VALUE, and Http2Settings never inserts SETTINGS_MAX_CONCURRENT_STREAMS by default (Http2Settings.java:305-307 only clamps a user-supplied value). Unless the applicati | Medium 5.3 | 12 Jun 2026 |
| CVE-2026-45674 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue. | High 8.7 | 12 Jun 2026 |
| CVE-2026-46340 | Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a *new* CompositeByteBuf every time. After N fragm | High 7.5 | 12 Jun 2026 |
| CVE-2026-45416 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLengt | High 7.5 | 12 Jun 2026 |
| CVE-2026-45536 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, netty_unix_socket_recvFd sets msg_control to `char control[CMSG_SPACE(sizeof(int))]` (line 940) — 24 bytes on 64-bit Linux. A peer-sent SCM_RIGHTS cmsg carrying two ints has cmsg_len = CMSG_LEN(8) = 24, which fits exactly with no MSG_CTRUNC, so the kernel inst | Medium 4.0 | 12 Jun 2026 |
| CVE-2026-45673 | Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DNS resolver uses a predictable PRNG for generating DNS transaction IDs and defaults to a static UDP source port. This combination reduces the entropy of DNS queries, enabling DNS Cache Poisoning (Kaminsky attack). Versions 4.1.135.Final and 4.2.15.Fin | Medium 6.8 | 12 Jun 2026 |
| CVE-2026-44893 | Netty is a network application framework for development of protocol servers and clients. In netty-codec-haproxy prior to versions 4.1.135.Final and 4.2.15.Final, when decoding a PP2_TYPE_SSL TLV, HAProxyMessage.readNextTLV() first calls `header.retainedSlice(header.readerIndex(), length)` and only then reads the 1-byte client field and 4-byte verify field. If the attacker sets the TLV length belo | High 7.5 | 12 Jun 2026 |
| CVE-2026-44894 | Netty is a network application framework for development of protocol servers and clients. NoQuicTokenHandler is the tokenHandler used when the application does not set one. Prior to version 4.2.15.Final, its writeToken() returns false (server will not send Retry — acceptable), but validateToken() unconditionally `return 0`. In QuicheQuicServerCodec.handlePacket(), a non-negative return from valida | High 7.5 | 12 Jun 2026 |
| CVE-2026-44892 | Netty is a network application framework for development of protocol servers and clients. Prior to version 4.2.15.Final, the default configuration of the `Http3ConnectionHandler` in the Netty HTTP/3 codec lacks an enforced maximum header size limit. When a peer does not explicitly specify `HTTP3_SETTINGS_MAX_FIELD_SECTION_SIZE`, the implementation defaults to an unbounded limit. This insecure defa | High 7.5 | 12 Jun 2026 |
| CVE-2026-44249 | Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue. | High 8.1 | 11 Jun 2026 |
| CVE-2026-44250 | Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending a crafted Redis payload with deeply nested arrays. This forces the server to allocate a massive number of state objects and collections, leading to memory exhaustion and an OutOfMemoryError. Versions 4. | High 7.5 | 11 Jun 2026 |
| CVE-2026-44890 | Netty is a network application framework for development of protocol servers and clients. In netty-codec-redis prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can cause DoS by sending crafted Redis payloads across multiple connections without `\r\n`. This exhausts the server's direct memory pool (OutOfDirectMemoryError), preventing legitimate connections from being processed. Version | High 7.5 | 11 Jun 2026 |
| CVE-2026-48040 | The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for cryptographic operations versions prior to 0.0.22.Final provide a fallback path for direct ByteBufs that do not expose their memory address through `hasMemoryAddress()`. This fallback occurs when | Medium 6.8 | 4 Jun 2026 |
| CVE-2026-41207 | The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand returns non-NULL on failure. The byte[] is filled with zeros and has no way to distinguish success from failure. Since this output is used as HKDF key material for the response AEAD, a failure silently produces an all-zero key. When EVP_HPKE_CTX_export fails it also returns an empty by | Medium 6.9 | 4 Jun 2026 |
| CVE-2026-44248 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader > maxBytesInMessage check. The decodeVariableHeader() can call othe | Medium 5.3 | 13 May 2026 |
| CVE-2026-42581 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the | Medium 5.8 | 13 May 2026 |
| CVE-2026-42582 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large lengt | High 7.5 | 13 May 2026 |
| CVE-2026-42583 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4. | High 7.5 | 13 May 2026 |
| CVE-2026-42584 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then | High 7.3 | 13 May 2026 |
| CVE-2026-42585 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final. | Medium 6.5 | 13 May 2026 |
| CVE-2026-42586 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\r\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can | Medium 6.8 | 13 May 2026 |
| CVE-2026-42587 | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or | High 7.5 | 13 May 2026 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 54 Last 12 months 78 Lifetime Request smuggling 40 % Parsing/validation 25 % Denial of service 20 % Cache poisoning 10 % Latest advisories Loading the feed Overview Netty is the asynchronous network framework the JVM infrastructure world runs on. Spark, Flink, Cassandra, Elasticsearch, gRPC-java and Spring WebFlux all move bytes through it, so a Netty defect is inherited by a large share of enterprise Java without anyone choosing to deploy it. 2026 has been extraordinary: 54 advisories carrying CVE-2026 identifiers landed in four batches between March and July, covering HTTP/1.1 and HTTP/2 smuggling variants, QPACK memory exhaustion and DNS cache poisoning. That is the heaviest disclosure year of anything in this category, against a codebase that has never had a paid programme of any kind. sorona.xyz pays you directly on qualified, reproduced findings. In scope The security policy takes reports through GitHub private vulnerability reporting under a ninety-day disclosure window and draws no boundary narrower than the Netty tree, so every codec and every transport in the repository is in bounds The HTTP/1.1 codec: request and response decoding, header validation, chunked handling, and the reconciliation of Content-Length against Transfer-Encoding The HTTP/2 codec: frame handling, HPACK, stream state, flow control and the HTTP/1-to-HTTP/2 translation layer downstream frameworks depend on The HTTP/3 and QUIC codecs, including QPACK encoding and decoding and the state each connection holds The DNS codec and resolver: transaction ID generation, response matching, bailiwick checks and cache behaviour Every other protocol codec shipped in the tree, including Redis, MQTT, STOMP, HAProxy protocol, SPDY, memcached, SMTP and the socks and haproxy proxy handlers The SSL and TLS layer in full, covering the JDK and OpenSSL-backed engines, certificate and hostname verification, and OCSP stapling validation The buffer allocator and the reference-counting model, where a leak or a double release is a memory-safety issue even on the JVM The channel pipeline, event loops and handler lifecycle, including exception propagation and what happens to a connection when a handler throws The WebSocket implementation from handshake through frame decoding, extension negotiation and continuation handling Native transports, epoll, kqueue and io_uring, and their JNI boundaries The codec-base machinery: cumulation, frame decoders and every place a length prefix from the wire drives an allocation Out of scope Downstream frameworks including Spark, Elasticsearch and Spring WebFlux as products, unless the defect is in Netty's own code JDK and OpenSSL defects that reach Netty as a dependency Pipelines a downstream project assembled unsafely out of components that behave correctly on their own Denial of service proportional to connection count with no amplification factor Findings already covered by one of the published 2026 advisory batches Branches the project no longer maintains Most-valued findings Request smuggling and desync across the HTTP/1.1 and HTTP/2 codecs, including the h2-to-h1 translation path. This is the densest part of the 2026 record and the highest-impact class the project produces Anything letting a Netty-based server disagree with a front-end proxy about where one request ends and the next begins, since the framework is deployed both as the edge and as the origin Memory exhaustion in HTTP/2 and HTTP/3 state handling, the QPACK class from the 2026 batches, because a Netty process typically holds tens of thousands of connections and dies for all of them at once DNS resolver defects: predictable transaction IDs, missing bailiwick checks and loose response matching all turn into cache poisoning against every service using Netty's resolver Certificate, hostname or OCSP validation bypass in the TLS layer, which silently removes the guarantee every downstream framework assumes it has Reference-counting defects in the buffer allocator reachable from a remote peer, since a use-after-release on a pooled buffer serves one connection's bytes to another Codec defects in the non-HTTP protocols. A striking share of the 2026 batches landed in Redis, MQTT, STOMP and HAProxy protocol handling, and those codecs get a fraction of the attention Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report through GitHub private vulnerability reporting on netty/netty . The security policy names that channel and a ninety-day disclosure window CVEs here are issued with GitHub acting as the CNA rather than by the Netty maintainers, so the identifier arrives with the advisory Name the codec. Netty ships HTTP/1, HTTP/2, HTTP/3, DNS, Redis, MQTT, STOMP, HAProxy protocol and SPDY codecs, and a finding in one says nothing about the others Say whether the defect is in the codec itself or in how a pipeline assembles handlers, because almost every downstream project builds its own pipeline Include a failing test at the codec level as well as an end-to-end reproduction. Netty is a library, so the pipeline configuration is part of the repro State the branch. 4.1 and 4.2 are both in the field and downstream projects are spread across them Netty has never run a bounty, so there is no payment to negotiate on the project's side Disclosure Coordinated through GitHub private advisories under a stated ninety-day window, then published as a GHSA with GitHub acting as CNA. The 2026 pattern is batch publication, with four release waves between March and July, so a report is more likely to be held until the next batch than published on its own. Downstream matters here: every framework that embeds Netty has to cut a release before the fix reaches anybody. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability