6.5
Medium
CVE-2026-42580 Netty is an asynchronous, event-driven network application framework
Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| netty 4.2 | 4.2.0.Alpha1 → < 4.2.13.Final | 4.2.13.Final |
| netty 4.1 | earliest → < 4.1.133.Final | 4.1.133.Final |
| netty-codec-http 4.2 | 4.2.0.Alpha1 → < 4.2.13.Final | 4.2.13.Final |
| netty-codec-http 4.1 | earliest → < 4.1.133.Final | 4.1.133.Final |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of netty
The 95 CVEs of netty →
CVE-2026-100666
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to…
6.9
Medium
CVE-2026-100665
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC…
8.7
High
CVE-2026-100664
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority…
8.7
High
CVE-2026-100663
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1…
8.7
High