What’s Vulnerable › Vulnerabilities

CVE-2026-42582: Netty: HTTP/3 QPACK literal unbounded allocation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-05-13 · updated 2026-10-26
• Weakness: CWE-770

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.

Affected products

• netty: from 4.2.0 before 4.2.13 — fixed in 4.2.13

How to fix

Upgrade to a fixed version: netty 4.2.13. Check the vendor advisory for mitigations.

References

• https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw
• https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw

Get alerted when CVE-2026-42582 or the next vulnerability affects your stack