Cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*

An unauthenticated remote attacker can cause cumulative memory exhaustion and service denial by sending incomplete STOMP frames that trigger a buffer leak in Netty's StompSubframeDecoder.

A memory exhaustion vulnerability in Netty's SpdySessionHandler allows remote attackers to trigger JVM OutOfMemoryErrors via unbounded concurrent SPDY stream allocation.

The netty-codec-smtp component in Netty suffers from insufficient CRLF validation in the SMTP command-name field, representing an incomplete remediation for CVE-2025-59419 that enables potential SMTP command injection or response splitting.

The Netty SpdySessionHandler component is vulnerable to a denial of service attack via uncontrolled concurrent stream allocation, potentially exhausting JVM heap and direct memory.

A memory leak vulnerability in the Netty StompSubframeDecoder component (CVE-2026-93494) allows remote attackers to cause a Denial of Service by sending malformed STOMP frames.

Multiple vulnerabilities in the Netty framework allow a remote, unauthenticated attacker to trigger denial-of-service, bypass security, perform request smuggling, and manipulate or disclose data.

A vulnerability in the Netty TLS ClientHello parsing logic allows unauthenticated attackers to bypass SNI-based mTLS requirements by sending fragmented handshake data that triggers a fallback to a permissive default SSL context.

A vulnerability in Netty's HTTP/2 decompressor allows an unauthenticated attacker to trigger an uncontrolled memory leak leading to a JVM OutOfMemoryError via crafted HTTP/2 DATA frames.

A high-severity vulnerability, CVE-2026-55831, in Netty's SPDY SETTINGS decoder allows a remote unauthenticated attacker to trigger a denial of service by sending a crafted SPDY/3.1 SETTINGS frame that leads to excessive heap growth and CPU consumption due to unbounded map entries in `DefaultSpdySettingsFrame`.