7.5
High
CVE-2026-42583 Netty is an asynchronous, event-driven network application framework
Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| netty 4.2 | 4.2.0.Alpha1 → < 4.2.13.Final | 4.2.13.Final |
| netty 4.1 | earliest → < 4.1.133.Final | 4.1.133.Final |
| netty-codec 4.1 | earliest → < 4.1.133.Final | 4.1.133.Final |
| netty-codec-compression 4.2 | earliest → < 4.2.13.Final | 4.2.13.Final |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of netty
The 95 CVEs of netty →
CVE-2026-100666
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to…
6.9
Medium
CVE-2026-100665
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC…
8.7
High
CVE-2026-100664
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority…
8.7
High
CVE-2026-100663
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1…
8.7
High