io.netty:netty-handler (maven) has 12 known vulnerabilities, the worst rated CRITICAL. Upgrade to 4.2.17.Final or later to clear all of them. No malicious-package signal is recorded.
A fragmented TLS ClientHello whose handshake header spans multiple records makes Netty silently fall back to the default SslContext; where per-SNI selection is…
// questionsIs io.netty:netty-handler safe to install?
CyberXYZ does not call a package safe in absolute terms. It records 12 known vulnerabilities for io.netty:netty-handler (maven), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does io.netty:netty-handler have known vulnerabilities?
Yes. CyberXYZ records 12 known vulnerabilities for io.netty:netty-handler (maven), the worst rated CRITICAL. These include GHSA-c4c3-7fpv-j4q5, GHSA-c653-97m9-rcg9, GHSA-x4gw-5cx5-pgmh, GHSA-3qp7-7mw8-wx86, GHSA-4g8c-wm8x-jfhw.
Which version of io.netty:netty-handler should I use?
4.2.17.Final or later clears every advisory recorded for io.netty:netty-handler (maven). Check the release you pick before installing it.
How do I check io.netty:netty-handler before installing?
Search io.netty:netty-handler in CyberXYZ Check at https://cyberxyz.io/check?q=io.netty%3Anetty-handler. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 09:33 UTC. The most recent advisory here was published 2026-09-08. Updated continuously from NVD, GHSA, OSV and CNA feeds.