Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-42580

Netty: HTTP Request Smuggling due to incorrect chunk size parsing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

netty netty

  • >= 4.2.0.Alpha1, < 4.2.13.Finalaffected
  • < 4.1.133.Finalaffected

io.netty netty-codec-http

  • >= 4.2.0.Alpha1, < 4.2.13.Finalaffected
  • < 4.1.133.Finalaffected

References