io.netty.incubator:netty-incubator-codec-bhttp vulnerabilities
CVEs whose affected-version data names the io.netty.incubator:netty-incubator-codec-bhttp package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-61799Medium· 5.3netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
▾ Sunlitnetty · io.netty.incubator:netty-incubator-codec-bhttpvia GHSA
CVE-2026-63124High· 7.5netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
netty-incubator-codec-ohttp: Binary HTTP parser infinite loop on known-length field section boundary
▾ Twilightnetty · io.netty.incubator:netty-incubator-codec-bhttpvia GHSA
CVE-2026-61827Highnetty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
netty-incubator-codec-ohttp: BinaryHttpParser should enforce limits for variable lengths fields
▾ Twilightnetty · io.netty.incubator:netty-incubator-codec-bhttpvia GHSA
CVE-2026-63202High· 7.5netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
netty-incubator-codec-ohttp BinaryHttpParser: Unauthenticated CPU-exhaustion DoS via infinite loop in field-section decoding
▾ Twilightnetty · io.netty.incubator:netty-incubator-codec-bhttpvia GHSA