CVE-2026-42580: Netty: HTTP Request Smuggling due to incorrect chunk size parsing

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-05-13 · updated 2026-10-26
Weakness: CWE-190

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected products

netty: before 4.1.133; from 4.2.0 before 4.2.13 — fixed in 4.1.133, 4.2.13

How to fix

Upgrade to a fixed version: netty 4.1.133, 4.2.13. Check the vendor advisory for mitigations.

References

https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723
https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723

Get alerted when CVE-2026-42580 or the next vulnerability affects your stack