Netty: HTTP Request Smuggling due to incorrect chunk size parsing
Priority HIGH 68CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Partial Red Hat: 25 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00378 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial netty (netty): 4.2.13.Final, 4.1.133.Finalnetty-codec-http (io.netty): 4.2.13.Final, 4.1.133.Final+1 more productRed Hat: 25 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| netty | netty | 4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final | 4.2.13.Final, 4.1.133.Final | Patch available | CNA |
| netty | netty-codec-http | 4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final | 4.2.13.Final, 4.1.133.Final | Patch available | CNA |
| — | io.netty:netty-codec-http (Maven) | 4.2.0.Alpha1 to before 4.2.13.Final | 4.2.13.Final | Patch available | GHSA-m4cv-j2px-7723 |
| — | io.netty:netty-codec-http (Maven) | before 4.1.133.Final | 4.1.133.Final | Patch available | GHSA-m4cv-j2px-7723 |
- netty Vendornetty Affected 4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final Fixed in 4.2.13.Final, 4.1.133.Final Patch available CNA
- netty-codec-http Vendornetty Affected 4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final Fixed in 4.2.13.Final, 4.1.133.Final Patch available CNA
- io.netty:netty-codec-http (Maven) Vendor— Affected 4.2.0.Alpha1 to before 4.2.13.Final Fixed in 4.2.13.Final Patch available GHSA-m4cv-j2px-7723
- io.netty:netty-codec-http (Maven) Vendor— Affected before 4.1.133.Final Fixed in 4.1.133.Final Patch available GHSA-m4cv-j2px-7723
Remediation
- Fix · CNA netty (netty) Fixed in 4.2.13.Final, 4.1.133.Final
- Fix · CNA netty-codec-http (io.netty) Fixed in 4.2.13.Final, 4.1.133.Final
- Fix · GHSA-m4cv-j2px-7723 io.netty:netty-codec-http (Maven) Fixed in 4.2.13.Final Advisory →
- Fix · GHSA-m4cv-j2px-7723 io.netty:netty-codec-http (Maven) Fixed in 4.1.133.Final Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Process Automation 7 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42580
- 2026-10-03 Alias added: GHSA-m4cv-j2px-7723
References
More Netty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
- TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
- TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
- TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
- TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
Sources
- CVE-2026-42580 · CVE Program
- CVE-2026-42580 · NVD
- FIRST EPSS
- GHSA-m4cv-j2px-7723 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-42580 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences