Single jar, zero runtime dependencies, fully offline, Java 17+.

Why this exists

The seven advisories each name a different fix version. On the 4.1 line they are 124 / 132 / 135 / 135 / 135 / 136 / 136. Follow any single advisory and you are still inside the affected range of the others. The version that clears all seven has to be computed — and it is written on none of them.

The same is true, with entirely different numbers, on the 4.2 line (4 / 11 / 15 / 15 / 15 / 16 / 16). People sitting on 4.2.15.Final have fixed five of the seven and often assume they are "on the new line".

And it does not scan pom.xml — on purpose

If you use Spring WebFlux, netty-codec-http2 arrives through

The artifactId never appears in your pom.xml. A pom-based check answers "I don't use it", which is wrong. This tool reads the jars that actually ship.

Usage

--utf8 / --gbk if the output is mojibake on a Windows console.

Example:

⚠️ 4.1.136.Final clears these seven — it does not clear netty-codec-http

This tool answers for one module: io.netty:netty-codec-http2. That scope is deliberate, but it is easy to read the answer as "upgrade to 4.1.136 and you are done", so this needs saying plainly:

netty-codec-http2 declares netty-codec-http as a compile dependency with <version>${project.version}</version> — the two versions are pinned to each other. So the moment you take netty-codec-http2:4.1.136.Final, you are also running netty-codec-http:4.1.136.Final, and CVE-2026-59903 on that module covers <= 4.1.136.Final. Its fix is 4.1.137.Final (4.2 line: this tool says 4.2.16, that module needs 4.2.17).

Nothing above is a correction to the seven CVEs judged here — those numbers stand. It is a reminder that "one Netty version number" hides the fact that each module has its own "fixed in" version. If you want that side checked too: https://github.com/xiaoqiMikko/netty-http-check

What it does not claim

• Only these seven. Clean output does not mean Netty is problem-free.
• Four of the seven are medium. Only CVE-2025-55163, CVE-2026-33871 and CVE-2026-56819 are rated high. The tool prints each severity separately and so should you.
• It never guesses. An unparseable version, an unknown release line (4.0, 5.0), an unreadable archive — all reported as cannot judge, never as safe.
• grpc-netty-shaded is detected, but only CVE-2025-55163 lists that coordinate. "The advisory doesn't list it" is not "it isn't affected".

One honest oddity, surfaced rather than hidden

CVE-2026-33871 on the 4.2 line: the affected range is < 4.2.10.Final, but the stated fix is 4.2.11.Final. 4.2.10 falls between them — outside the range, below the fix. The tool reports this explicitly instead of letting it drop into the default branch, which is "safe".

The rule table is generated, not typed

tools/gen_rules.py builds RuleTable.java straight from the GitHub advisories and refuses to emit anything unless five assertions hold — including that the computed intersection really is 4.1.136.Final / 4.2.16.Final, and that those exist on Maven Central while a sentinel version 404s.

tools/recheck_before_publish.py re-verifies the load-bearing claims through deliberately unrelated sources: NVD (not OSV — its Maven data mirrors GHSA), Maven Central, and the real jars' bytecode. The bytecode check is two-directional: the fix marker must be present in 4.1.136 and absent in 4.1.135. That second half caught a bad check on the first run.

Build

License

MIT

Exit codes

🔴 4 was added on 2026-09-09, and the reason is worth stating. Before that, an unreadable file only produced a line on stdout while the exit code stayed 0. The printed warning is for humans; CI and scripts read the exit code — so "I could not read it" silently meant "pass" in automation. A corrupt, encrypted or partially downloaded jar quietly turned into "nothing found".

"I could not read it" and "you are safe" must be two different sentences.

⚠️ A legitimately empty jar (a bare 22-byte EOCD record) is a real empty zip, not a broken file, and does not trigger 4 — false alarms are what make real alarms get ignored.

For the other exit codes, see the verdict levels and usage notes above.