CVE-2026-42577

Description

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final.

PUBLISHED Reserved 2026-04-28 | Published 2026-05-13 | Updated 2026-05-14 | Assigner GitHub_M

Problem types

CWE-772: Missing Release of Resource after Effective Lifetime

Product status

References

github.com/.../netty/security/advisories/GHSA-rwm7-x88c-3g2p

github.com/netty/netty/pull/16689

github.com/...ommit/0ec3d97fab376e243d328ac95fbd288ba0f6e22d

cve.org (CVE-2026-42577)

nvd.nist.gov (CVE-2026-42577)

Download JSON