io.netty/netty-handler-proxy vulnerabilities

Latest io.netty/netty-handler-proxy CVEs

Newest publication first

1. CVE-2026-42578 Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

   Published 2026-05-13

   Low·CVSS 2.9 EPSS 1.1%

   Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHea...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.