CWE-1035
CVEs classified under CWE-1035, newest first.
13 CVEsRSS
CVE-2026-93562Medium· 6.5A flaw was found in Netty's HTTP/1 decoder
A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbit…
CVE-2026-93579Medium· 6.5A flaw was found in Netty's HTTP/2 stack
A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When thes…
CVE-2026-93558High· 7.5PoCA flaw was found in Netty's WebSocketServerExtensionHandler
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unboun…
CVE-2026-93565High· 7.5A flaw was found in Netty RtspDecoder
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a spe…
CVE-2026-93564High· 7.5A flaw was found in Netty
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a D…
CVE-2026-93566Medium· 6.5A flaw was found in Netty
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker …
CVE-2026-93560High· 7.5A flaw was found in the Netty STOMP codec
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite dec…
CVE-2026-93492Medium· 5.3A flaw was found in Netty's HTTP/2 HpackEncoder
A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, l…
CVE-2026-93578Medium· 5.9PoCA flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client
A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate is…
CVE-2026-93575High· 7.5A flaw was found in Netty's MqttDecoder
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Re…
CVE-2026-93563High· 7.5A flaw was found in Netty's `SmtpResponseDecoder` component
A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without …
CVE-2026-93561Medium· 6.5A flaw was found in io.netty/netty-codec-memcache
A flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server ca…
CVE-2026-93494High· 7.5A flaw was found in Netty's StompSubframeDecoder component
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf…