Search: CVE-2026-50020

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.2%	CVE-2026-50020Netty · Prior to versions 4.1.135.Final and 4.2.15.Final, before reading the first request-line, HttpObjectDecoder skips every byte for which Medium5.3EPSS 0.2%2026-06-12GCVE DatabaseCVE-2026-50020 Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a vulnerability in HttpObjectDecoder where it skips all ISO control bytes and whitespace before reading the first HTTP request line. This behavior exceeds the HTTP specification's allowance to ignore only empty CRLF lines before the request line, potentially causing request-boundary confusion in pipelined or multiplexed transports. The issue is patched in versions 4.1.135.Final and 4.2.15.Final. EPSS 0.2%Vulnerability	GCVE Database	2026-06-12

Page 1 of 1