netty netty-incubator-codec-ohttp
6 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-54251 | < 0.0.23.Final | netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service | HIGH 8.7 | 0.5 % | ||
| CVE-2026-48480 | < 0.0.22.Final | netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation | MEDIUM 6.6 | 0.2 % | ||
| CVE-2026-48040 | < 0.0.22.Final | netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory … | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-41207 | < 0.0.21.Final | netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte[] on failures | MEDIUM 6.9 | 0.2 % | ||
| CVE-2024-40642 | < 0.0.13.Final | Absent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp | HIGH 8.1 | 0.7 % | ||
| CVE-2024-36121 | >= 0.0.3.Final, < 0.0.11.Final | netty-incubator-codec-ohttp's BoringSSLAEADContext Repeats Nonces | CRITICAL 9.1 | 0.3 % |