netty-handler-4.1.119.Final.jar: 6 vulnerabilities (highest severity is: 8.1) reachable

[mend-for-github-com]

Vulnerable Library - netty-handler-4.1.119.Final.jar

Library home page: https://netty.io/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/io.netty/netty-handler/4.1.119.Final/a0059b8d779ce566b524efd6d73ba4fcff3cd5d9/netty-handler-4.1.119.Final.jar

Vulnerabilities

Vulnerability	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (netty-handler version)	Remediation Possible**	Reachability
CVE-2025-58057	Medium	5.3	Not Defined	0.561%	netty-codec-4.1.119.Final.jar	Transitive	4.1.125.Final	✅	Reachable
CVE-2026-44249	High	8.1	Not Defined	0.573%	netty-handler-4.1.119.Final.jar	Direct	https://github.com/netty/netty.git - netty-4.2.15.Final,https://github.com/netty/netty.git - netty-4.1.135.Final	✅
CVE-2026-59901	High	7.5	Not Defined		netty-codec-4.1.119.Final.jar	Transitive	N/A*	❌
CVE-2026-50010	High	7.5	Not Defined	0.279%	netty-handler-4.1.119.Final.jar	Direct	https://github.com/netty/netty.git - 4.1.135.Final	✅
CVE-2026-45416	High	7.5	Not Defined	0.478%	netty-handler-4.1.119.Final.jar	Direct	https://github.com/netty/netty.git - netty-4.2.15.Final,https://github.com/netty/netty.git - netty-4.1.135.Final	✅
CVE-2026-42583	High	7.5	Not Defined	0.429%	netty-codec-4.1.119.Final.jar	Transitive	4.1.133.Final	✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-58057

Vulnerable Library - netty-codec-4.1.119.Final.jar

Library home page: https://netty.io/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/io.netty/netty-codec/4.1.119.Final/337ca8e8c3ef23925e02d56347b414d7616d1d02/netty-codec-4.1.119.Final.jar

Dependency Hierarchy:

• netty-handler-4.1.119.Final.jar (Root Library)
  • ❌ netty-codec-4.1.119.Final.jar (Vulnerable Library)

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

com.opentok.util.HttpClient (Application)
  -> org.asynchttpclient.DefaultAsyncHttpClient (Extension)
   -> org.asynchttpclient.netty.channel.ChannelManager (Extension)
    -> io.netty.handler.ssl.SslHandler (Extension)
     -> ❌ io.netty.handler.codec.ByteToMessageDecoder$Cumulator (Vulnerable Component)

Vulnerability Details

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In netty-codec-compression versions 4.1.124.Final and below, and netty-codec versions 4.2.4.Final and below, when supplied with specially crafted input, BrotliDecoder and certain other decompression decoders will allocate a large number of reachable byte buffers, which can lead to denial of service. BrotliDecoder.decompress has no limit in how often it calls pull, decompressing data 64K bytes at a time. The buffers are saved in the output list, and remain reachable until OOM is hit. This is fixed in versions 4.1.125.Final of netty-codec and 4.2.5.Final of netty-codec-compression.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2025-09-03

URL: CVE-2025-58057

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.561%

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-09-03

Fix Resolution (io.netty:netty-codec): 4.1.125.Final

Direct dependency fix Resolution (io.netty:netty-handler): 4.1.125.Final

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-44249

Vulnerable Library - netty-handler-4.1.119.Final.jar

Library home page: https://netty.io/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/io.netty/netty-handler/4.1.119.Final/a0059b8d779ce566b524efd6d73ba4fcff3cd5d9/netty-handler-4.1.119.Final.jar

Dependency Hierarchy:

• ❌ netty-handler-4.1.119.Final.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Publish Date: 2026-06-11

URL: CVE-2026-44249

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.573%

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-08

Fix Resolution: https://github.com/netty/netty.git - netty-4.2.15.Final,https://github.com/netty/netty.git - netty-4.1.135.Final

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-59901

Vulnerable Library - netty-codec-4.1.119.Final.jar

Library home page: https://netty.io/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/io.netty/netty-codec/4.1.119.Final/337ca8e8c3ef23925e02d56347b414d7616d1d02/netty-codec-4.1.119.Final.jar

Dependency Hierarchy:

• netty-handler-4.1.119.Final.jar (Root Library)
  • ❌ netty-codec-4.1.119.Final.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the "Bzip2Decoder" handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malformed bzip2 stream that permanently captures the event-loop thread in an infinite loop. The vulnerability exists in the run-length encoding (RLE) state machine within ["Bzip2BlockDecompressor.read()"]. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.

Publish Date: 2026-07-29

URL: CVE-2026-59901

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-558v-64gr-wgg4

Release Date: 2026-07-22

Fix Resolution: io.netty:netty-codec-compression:4.2.16.Final,io.netty:netty-codec:4.1.136.Final

CVE-2026-50010

Vulnerable Library - netty-handler-4.1.119.Final.jar

Library home page: https://netty.io/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/io.netty/netty-handler/4.1.119.Final/a0059b8d779ce566b524efd6d73ba4fcff3cd5d9/netty-handler-4.1.119.Final.jar

Dependency Hierarchy:

• ❌ netty-handler-4.1.119.Final.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrustManager, neither SunJSSE's internal AbstractTrustManagerWrapper nor Netty's own OpenSslX509TrustManagerWrapper will re-wrap it to add endpoint-identification. Consequently, even though Netty 4.2 sets endpointIdentificationAlgorithm="HTTPS" by default, a client built with "SslContextBuilder.forClient().trustManager(somePlainX509TrustManager)" performs no hostname verification at all. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Publish Date: 2026-06-12

URL: CVE-2026-50010

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.279%

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-12

Fix Resolution: https://github.com/netty/netty.git - 4.1.135.Final

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-45416

Vulnerable Library - netty-handler-4.1.119.Final.jar

Library home page: https://netty.io/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/io.netty/netty-handler/4.1.119.Final/a0059b8d779ce566b524efd6d73ba4fcff3cd5d9/netty-handler-4.1.119.Final.jar

Dependency Hierarchy:

• ❌ netty-handler-4.1.119.Final.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates "ctx.alloc().buffer(handshakeLength)" (line 161). The guard at line 140 is "handshakeLength > maxClientHelloLength && maxClientHelloLength != 0", and the commonly-used SniHandler/AbstractSniHandler constructors (SniHandler(Mapping), SniHandler(AsyncMapping), AbstractSniHandler()) pass maxClientHelloLength=0 and handshakeTimeoutMillis=0, so the length guard is disabled and no timeout is scheduled. A 16 MiB request exceeds the default pooled chunk size and becomes a huge/unpooled allocation performed immediately. The buffer is retained in the handler until the channel closes. Versions 4.1.135.Final and 4.2.15.Final patch the issue.

Publish Date: 2026-06-12

URL: CVE-2026-45416

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.478%

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-09

Fix Resolution: https://github.com/netty/netty.git - netty-4.2.15.Final,https://github.com/netty/netty.git - netty-4.1.135.Final

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2026-42583

Vulnerable Library - netty-codec-4.1.119.Final.jar

Library home page: https://netty.io/

Path to dependency file: /build.gradle

Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/io.netty/netty-codec/4.1.119.Final/337ca8e8c3ef23925e02d56347b414d7616d1d02/netty-codec-4.1.119.Final.jar

Dependency Hierarchy:

• netty-handler-4.1.119.Final.jar (Root Library)
  • ❌ netty-codec-4.1.119.Final.jar (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Publish Date: 2026-05-13

URL: CVE-2026-42583

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.429%

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-05-08

Fix Resolution (io.netty:netty-codec): 4.1.133.Final

Direct dependency fix Resolution (io.netty:netty-handler): 4.1.133.Final

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.