6.5
Moyenne
CVE-2026-42580 Netty is an asynchronous, event-driven network application framework
Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| netty 4.2 | 4.2.0.Alpha1 → < 4.2.13.Final | 4.2.13.Final |
| netty 4.1 | premières → < 4.1.133.Final | 4.1.133.Final |
| netty-codec-http 4.2 | 4.2.0.Alpha1 → < 4.2.13.Final | 4.2.13.Final |
| netty-codec-http 4.1 | premières → < 4.1.133.Final | 4.1.133.Final |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de netty
Les 95 CVE de netty →
CVE-2026-100666
Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to…
6.9
Moyenne
CVE-2026-100665
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC…
8.7
Élevée
CVE-2026-100664
Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority…
8.7
Élevée
CVE-2026-100663
Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1…
8.7
Élevée