← CVE Intelligence

CVE-2026-42580

Netty: HTTP Request Smuggling due to incorrect chunk size parsing PUBLISHED

Description (CNA)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected (CNA)

Vendor / productVersions
netty / nettyaffected >= 4.2.0.Alpha1, < 4.2.13.Final; affected < 4.1.133.Final
io.netty / netty-codec-httpaffected >= 4.2.0.Alpha1, < 4.2.13.Final; affected < 4.1.133.Final

CWE

CWE-444, CWE-190

References

ADP enrichment

CISA-ADP

No English description supplied.