Read the docs
TI-2026-30863 Aliases CVE-2026-42583GHSA-mj4r-2hfc-f8p6

Netty: Lz4FrameDecoder resource exhaustion

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 11 fixed, 14 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00461 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial netty (netty): 4.2.13.Final, 4.1.133.Finalnetty-codec (io.netty): 4.1.133.Final+3 more productsRed Hat: 11 advisoriesRed Hat: 11 fixed, 14 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nettynetty4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final4.2.13.Final, 4.1.133.FinalPatch availableCNA
nettynetty-codecbefore 4.1.133.Final4.1.133.FinalPatch availableCNA
nettynetty-codec-compressionbefore 4.2.13.Final4.2.13.FinalPatch availableCNA
—io.netty:netty-codec-compression (Maven)before 4.2.13.Final4.2.13.FinalPatch availableGHSA-mj4r-2hfc-f8p6
—io.netty:netty-codec (Maven)before 4.1.133.Final4.1.133.FinalPatch availableGHSA-mj4r-2hfc-f8p6
  • netty Vendornetty Affected 4.2.0.Alpha1 to before 4.2.13.Final; before 4.1.133.Final Fixed in 4.2.13.Final, 4.1.133.Final Patch available CNA
  • netty-codec Vendornetty Affected before 4.1.133.Final Fixed in 4.1.133.Final Patch available CNA
  • netty-codec-compression Vendornetty Affected before 4.2.13.Final Fixed in 4.2.13.Final Patch available CNA
  • io.netty:netty-codec-compression (Maven) Vendor— Affected before 4.2.13.Final Fixed in 4.2.13.Final Patch available GHSA-mj4r-2hfc-f8p6
  • io.netty:netty-codec (Maven) Vendor— Affected before 4.1.133.Final Fixed in 4.1.133.Final Patch available GHSA-mj4r-2hfc-f8p6

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*before 4.1.133; 4.2.0 to before 4.2.13Vulnerablenetty
  • cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* Versions before 4.1.133; 4.2.0 to before 4.2.13 Vulnerable ·netty

Remediation

  • Fix · CNA netty (netty) Fixed in 4.2.13.Final, 4.1.133.Final
  • Fix · CNA netty-codec (io.netty) Fixed in 4.1.133.Final
  • Fix · CNA netty-codec-compression (io.netty) Fixed in 4.2.13.Final
  • Fix · GHSA-mj4r-2hfc-f8p6 io.netty:netty-codec-compression (Maven) Fixed in 4.2.13.Final Advisory →
  • Fix · GHSA-mj4r-2hfc-f8p6 io.netty:netty-codec (Maven) Fixed in 4.1.133.Final Advisory →

Red Hat 11 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:73976 Released 2026-09-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.16 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-hibernate-5.1.17-5.Final_redhat_00006.1.ep7.el7, eap7-hibernate-core-5.1.17-5.Final_redhat_00006.1.ep7.el7, eap7-hibernate-entitymanager-5.1.17-5.Final_redhat_00006.1.ep7.el7 +7
  • RHSA-2026:73644 Released 2026-09-30 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.19 Update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hibernate-5.3.39-1.Final_redhat_00001.1.el7eap, eap7-hibernate-core-5.3.39-1.Final_redhat_00001.1.el7eap, eap7-hibernate-entitymanager-5.3.39-1.Final_redhat_00001.1.el7eap +31
Show 8 more Red Hat advisories
  • RHSA-2026:69459 Released 2026-09-21 · Red Hat rating Important
    AMQ Clients 2026.Q3
    • AMQ Clients 2026.Q3
  • RHSA-2026:66488 Released 2026-09-10 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.1 release and security update
    • Red Hat AMQ Broker 7.14.1
  • RHSA-2026:65126 Released 2026-09-08 · Red Hat rating Important
    RHOAI 2.25.11 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:54435 Released 2026-08-12 · Red Hat rating Important
    Streams for Apache Kafka 3.2.1 release and security update
    • Streams for Apache Kafka 3.2.1
  • RHSA-2026:41951 Released 2026-07-20 · Red Hat rating Important
    Red Hat Data Grid 8.6.2 security update
    • Red Hat Data Grid 8.6.2
  • RHSA-2026:36820 Released 2026-07-08 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.29.0 Release.
    • Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
  • RHSA-2026:34608 Released 2026-07-02 · Red Hat rating Important
    Streams for Apache Kafka 2.9.4 release and security update
    • Streams for Apache Kafka 2.9.4
  • RHSA-2026:30049 Released 2026-06-25 · Red Hat rating Important
    Red Hat build of Keycloak 26.4.13 Security Update
    • Red Hat build of Keycloak 26.4.13

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix yet
Red Hat Build of KeycloakAffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix yet
streams for Apache Kafka 2AffectedNo fix yet
AMQ Clients 2026.Q3Fixed RHSA-2026:69459
Red Hat AMQ Broker 7.14.1Fixed RHSA-2026:66488
Red Hat Data Grid 8.6.2Fixed RHSA-2026:41951
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2026:73976
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2026:73644
Red Hat OpenShift AI 2.25Fixed RHSA-2026:65126
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift Dev Spaces 3.29Fixed RHSA-2026:36820
Red Hat build of Keycloak 26.4.13Fixed RHSA-2026:30049
Streams for Apache Kafka 2.9.4Fixed RHSA-2026:34608
Streams for Apache Kafka 3.2.1Fixed RHSA-2026:54435
Not affected: 14 products
  • Cryostat 4
  • Red Hat Build of Keycloak
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Dev Spaces 3.29
  • Red Hat Satellite 6
  • Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42583
  2. 2026-10-03 Alias added: GHSA-mj4r-2hfc-f8p6
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  5. 2026-10-23 Fix available: RHSA-2026:30049 · Red Hat
  6. 2026-10-23 Fix available: Red Hat build of Keycloak 26.4.13 · Red Hat

References

Exploit 1

Advisory 1

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-30861 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization CVSS 3.1CRITICAL 9.8
  • TI-2026-30864 Netty: HttpClientCodec response desynchronization CVSS 3.1CRITICAL 9.1
  • TI-2026-30859 Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder) CVSS 3.1CRITICAL 9.1
  • TI-2026-40973 Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks CVSS 3.1CRITICAL 9.1
  • TI-2026-40972 Uncontrolled resource consumption in netty CVSS 3.1HIGH 7.5
See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences