This release appears generally suitable to depend on: it has a stable non-prerelease version profile, regular release activity with 11 releases in the last 12 months, no registry deprecation, a bounded runtime dependency set, no install-time lifecycle scripts, and Maven PGP build provenance. The main concerns are that no license declaration or license file was detected and no source repository was declared, reducing legal and maintenance transparency; however, the artifact is a focused compiled Netty module, so the absence of README, tests, and changelog content in the package is not by itself a material health problem. Repository-based maintenance and transparency signals were not available, so confidence is moderate rather than high.
76%
Total Score
100
90
100
100
No declared license and no license file were detected, creating a genuine licensing and transparency concern for adoption.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-563243 New netty-codec-classes-quic is vulnerable to Improper Certificate Validation in versions 4.2.11.Final - 4.2.17.Final. | 4.2.11.Final - 4.2.17.Final | High |
CVE-2026-50009 io.netty:netty-codec-classes-quic is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 4.2.0.Final - 4.2.14.Final. | 4.2.0.Final - 4.2.14.Final | Medium |
CVE-2026-44894 io.netty:netty-codec-classes-quic is vulnerable to Improper Verification of Source of a Communication Channel in versions 4.2.0.Final - 4.2.14.Final. | 4.2.0.Final - 4.2.14.Final | High |
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
${project.groupId}:netty-common Version 4.2.18.Final | — | — |
${project.groupId}:netty-buffer Version 4.2.18.Final | — | — |
${project.groupId}:netty-transport Version 4.2.18.Final | — | — |
${project.groupId}:netty-codec-base Version 4.2.18.Final | — | — |
${project.groupId}:netty-handler Version 4.2.18.Final | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.