CVE-2026-42580

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

PUBLISHED Reserved 2026-04-28 | Published 2026-05-13 | Updated 2026-05-14 | Assigner GitHub_M

Problem types

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

CWE-190: Integer Overflow or Wraparound

Product status

References

github.com/.../netty/security/advisories/GHSA-m4cv-j2px-7723 exploit

github.com/.../netty/security/advisories/GHSA-m4cv-j2px-7723

cve.org (CVE-2026-42580)

nvd.nist.gov (CVE-2026-42580)

Download JSON