CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 8:00 PM ET)

What this means for you

This week: 3,185 CVEs published, 234 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,185; Show in the list
Critical, last 7 days: 234; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product netty:netty. Show all products

89 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2019-16869	High 7.5	Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling. Assigned by mitre	Sep 26, 2019
CVE-2019-20445	Critical 9.1	HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header. Assigned by mitre	Jan 29, 2020
CVE-2019-20444	Critical 9.1	HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invali… Assigned by mitre	Jan 29, 2020
CVE-2021-21290	Medium 6.2	Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files Assigned by GitHub_M	Feb 8, 2021
CVE-2021-21295	Medium 5.9	Possible request smuggling in HTTP/2 due missing validation Assigned by GitHub_M	Mar 9, 2021
CVE-2021-21409	Medium 5.9	Possible request smuggling in HTTP/2 due missing validation of content-length Assigned by GitHub_M	Mar 30, 2021
CVE-2021-37137	High 7.5	The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Assigned by JFROG	Oct 18, 2021
CVE-2021-37136	High 7.5	The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). Assigned by JFROG	Oct 18, 2021
CVE-2021-43797	Medium 6.5	HTTP fails to validate against control chars in header names which may lead to HTTP request smuggling Assigned by GitHub_M	Dec 8, 2021
CVE-2023-44487 Known exploited	High 7.5	The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Assigned by mitre	Oct 9, 2023

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.