CVE-2026-42585 Security Details

CVE ID

CVE-2026-42585

CWE

CWE-444

CVE Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Published

May 7, 2026

CVSS Score & Severity

7.5High

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS Score

0.013%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

io/netty/handler/codec/http/HttpMessageDecoder.readHeaders(Lio/netty/buffer/ByteBuf;)Lio/netty/handler/codec/http/HttpMessageDecoder$State;

JVMVulnerable params: 0

io/netty/handler/codec/http/HttpObjectDecoder.handleTransferEncodingChunkedWithContentLength(Lio/netty/handler/codec/http/HttpMessage;)V

JVMVulnerable params: 0

io/netty/handler/codec/http/HttpObjectDecoder.readHeaders(Lio/netty/buffer/ByteBuf;)Lio/netty/handler/codec/http/HttpObjectDecoder$State;

JVMVulnerable params: 0

org/jboss/netty/handler/codec/http/HttpMessageDecoder.readHeaders(Lorg/jboss/netty/buffer/ChannelBuffer;)Lorg/jboss/netty/handler/codec/http/HttpMessageDecoder$State;

JVMVulnerable params: 0

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · netty/nettyPROJECT

GitHub · Advisory · GHSA-38f8-5428-x5cvTHIRD_PARTY