Live tracker of exploited and high-impact vulnerabilities
New vulnerabilities from CERTs, vendors, researchers and newsrooms in 180+ countries, checked automatically, with how widely each one is being exploited, warned about and covered.
Panic meter
Connecting- Researchers talking
- –
- News outlets covering
- –
- CERTs and agencies warning
- –
Distinct people and organisations discussing new vulnerabilities in the past 24 hours.
Trending now
Outbreak map
- Countries in the news
- –
- Agencies warning
- –
- Countries warned
- –
- Patient zero
- –
Daily panic
Vulnerabilities
netty vulnerabilities
Every netty vulnerability Vulnocalypse is tracking, newest first: whether it’s being exploited, which CERTs have warned about it and how widely it’s covered. Subscribe with the RSS feed for netty alerts.
- 34impact
Netty susceptible to HTTP/2 Reset Attack with different on-the-wire signature
0 news outlets0 CERTs0 researchersCVSS 6.9 - 42impact
Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass
0 news outlets0 CERTs0 researchersCVSS 8.7 - 27impact
Netty: STOMP CONNECT Frame Header Injection
0 news outlets0 CERTs0 researchersCVSS 6.5 - 37impact
Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
0 news outlets0 CERTs0 researchersCVSS 7.5 - 32impact
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
0 news outlets0 CERTs0 researchersCVSS 6.3 - 40impact
Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
0 news outlets0 CERTs0 researchersCVSS 8.7 - 34impact
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
0 news outlets0 CERTs0 researchersCVSS 7.4 - 25impact
Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
0 news outlets0 CERTs0 researchersCVSS 5.7 - 37impact
Netty: Denial of Service in XmlFrameDecoder via CPU Exhaustion
0 news outlets0 CERTs0 researchersCVSS 7.5 - 28impact
Netty: Memory Leak in DNS Record Decoder via Malformed Domain Names
0 news outlets0 CERTs0 researchersCVSS 5.3 - 24impact
Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
0 news outlets0 CERTs0 researchersCVSS 2.9 - 32impact
Netty: TOCTOU in OcspServerCertificateValidator
0 news outlets0 CERTs0 researchersCVSS 7.4 - 39impact
Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
0 news outlets0 CERTs0 researchersCVSS 7.5 - 39impact
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
0 news outlets0 CERTs0 researchersCVSS 8.3 - 34impact
Netty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
0 news outlets0 CERTs0 researchersCVSS 6.9 - 22impact
Netty: Unix-socket fd receive leaks descriptors when peer sends two at once
0 news outlets0 CERTs0 researchersCVSS 4.0 - 37impact
Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder
0 news outlets0 CERTs0 researchersCVSS 7.5 - 26impact
Netty QUIC stateless reset token material exposed through header-visible connection IDs
0 news outlets0 CERTs0 researchersCVSS 4.8 - 38impact
Netty has Insufficient Bailiwick Validation for NS Records
0 news outlets0 CERTs0 researchersCVSS 8.7 - 32impact
Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator
0 news outlets0 CERTs0 researchersCVSS 7.4 - 36impact
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types
0 news outlets0 CERTs0 researchersCVSS 7.5 - 30impact
Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite
0 news outlets0 CERTs0 researchersCVSS 6.5 - 36impact
Netty has a Vulnerable Default Configuration Which Leads to Denial of Service via Unbounded HTTP/3 Header Size
0 news outlets0 CERTs0 researchersCVSS 7.5 - 30impact
Netty before 4.2.16.Final SOCKS Proxy Null Byte Injection
0 news outlets0 CERTs0 researchersCVSS 6.3 - 32impact
Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
0 news outlets0 CERTs0 researchersCVSS 5.8 - 34impact
Netty: Memory Exhaustion in SctpMessageCompletionHandler
0 news outlets0 CERTs0 researchersCVSS 7.5 - 29impact
Netty HTTP/2: Advertised MAX_CONCURRENT_STREAMS are not enforced
0 news outlets0 CERTs0 researchersCVSS 5.3 - 33impact
Netty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
0 news outlets0 CERTs0 researchersCVSS 6.9 - 21impact
Netty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address
0 news outlets0 CERTs0 researchersCVSS 5.5 - 28impact
Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()
0 news outlets0 CERTs0 researchersCVSS 5.3 - 39impact
Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
0 news outlets0 CERTs0 researchersCVSS 8.7 - 40impact
SslHandler doesn't correctly validate packets which can lead to native crash when using native SSLEngine
0 news outlets0 CERTs0 researchersCVSS 7.5 - 38impact
Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
0 news outlets0 CERTs0 researchersCVSS 8.7 - 38impact
Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
0 news outlets0 CERTs0 researchersCVSS 9.1 - 40impact
Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking
0 news outlets0 CERTs0 researchersCVSS 8.1 - 37impact
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
0 news outlets0 CERTs0 researchersCVSS 7.5 - 37impact
Netty SPDY SETTINGS frame count materializes unbounded settings map
0 news outlets0 CERTs0 researchersCVSS 7.5 - 30impact
Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding
0 news outlets0 CERTs0 researchersCVSS 6.5 - 37impact
Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)
0 news outlets0 CERTs0 researchersCVSS 7.5 - 37impact
Netty's wrapping plain trust manager silently disables hostname verification
0 news outlets0 CERTs0 researchersCVSS 7.5 - 37impact
Netty SPDY zlib header block continues decoded expansion after maxHeaderSize truncation
0 news outlets0 CERTs0 researchersCVSS 7.5 - 27impact
Netty has a Security Control Bypass via CORS Short-Circuit Failure
0 news outlets0 CERTs0 researchersCVSS 6.5 - 40impact
Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
0 news outlets0 CERTs0 researchersCVSS 8.7 - 32impact
Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
0 news outlets0 CERTs0 researchersCVSS 7.3
Sources
CERTs and cyber security agencies, national news outlets in every country we could find, vendor advisories, research blogs and the security press. Every source is polled on its own schedule, by RSS where possible and by headless browser where not. Broken feeds are repaired automatically; anything still failing is listed here.
Sources admin
Enter the admin token from your server’s .env file (ADMIN_TOKEN). It’s sent once to start a session and isn’t stored in this browser.
Recent sign-in activity
Pipeline, last 24 hours
How many articles each type of source produced, how many were read in full, and how many were linked to a vulnerability. “Unmatched” are articles that look like vulnerability news but couldn’t be linked; the reasons and examples show what to improve.
Add a source
Coverage
All sources
How it works
Vulnocalypse reads vulnerability registries, government CERTs, vendor advisories, research blogs and newsrooms around the clock, links everything that refers to the same vulnerability, and only shows what passes automated validation.
What gets into the feed
A vulnerability is admitted when it is corroborated, either through a published CVE record or through at least two independent organisations, and its impact score reaches 60 out of 100. Anything listed in a known-exploited catalogue is admitted regardless of score. Once admitted, an entry stays, so the feed never flickers.
Impact score
Up to 30 points for severity (CVSS, or inferred from the description when no score exists), 25 for exploitation, 15 for blast radius by product category (edge devices and identity systems score highest), 15 for attention from news, CERTs and researchers, 10 for EPSS exploitation probability, and 5 for pre-authentication. Every entry shows its breakdown.
Exploitation status
We only mark something exploited when there is a citable source: a KEV listing (CISA, VulnCheck or ENISA), a statement from the vendor or a government agency, CISA’s SSVC assessment, or at least two independent organisations reporting attacks with no later denial from the vendor. Phrases like “no evidence of exploitation” are detected and count against a claim.
Validation, without humans
Identifiers are checked against the CVE List; rejected or non-existent CVEs are dropped. Titles, vendors, products and CVSS come from the official record rather than from headlines. Wire stories syndicated across outlets are counted once. Roundups that list dozens of CVEs only count the ones they actually discuss. Reports without an identifier wait for corroboration and are merged into the right CVE once one is assigned. Every decision is logged and shown on each vulnerability’s page.
The Panic meter
Three numbers over the past 24 hours, counting only vulnerabilities first seen in the last 14 days: distinct researchers posting about them, distinct news organisations covering them, and distinct CERTs and agencies warning about them. Each is ranked against its own 90-day history, weighted 35% CERTs, 35% news and 30% researchers, and stretched so the top levels stay rare. Each day’s score is split across the vulnerabilities that caused it.
The outbreak map
The map shows two things for every country: how many national news outlets are covering new vulnerabilities, and whether the national CERT or cyber security agency has issued a warning. National outlets are read directly, through local-language Google News editions, and through GDELT, which attributes coverage in over 100 languages to its source country. International security press is left off the map so it shows national attention, not trade coverage. Replay the spread to watch a vulnerability travel from patient zero across the world.
Subscribe
- Everything (RSS), also as Atom and JSON Feed
- Exploited only and KEV-listed only
- Updates: new KEV listings, exploitation changes and public exploits for tracked vulnerabilities
- Per vendor:
/feed.xml?vendor=Fortinet, or by score:/feed.xml?min_score=80
Use it from an AI agent
Vulnocalypse runs a read-only MCP server. Add it to any MCP client as a remote server:
https://vulnocalypse.com/mcpTools: get_feed, search_vulnerabilities, get_vulnerability, check_exposure (send the products you run and get back anything that affects them), get_panic and explain_panic_day. The JSON API is documented at /api/docs.