Medium severity · published May 13, 2026
CVE-2026-42580
Netty: HTTP Request Smuggling due to incorrect chunk size parsing
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netty · netty
>= 4.2.0.Alpha1, < 4.2.13.Final; < 4.1.133.Final · source: vendor, NVD
NE
netty-codec-http · io.netty
>= 4.2.0.Alpha1, < 4.2.13.Final; < 4.1.133.Final · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42580
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42580
Exploit
https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723
More from netty-codec-http
9.1
CVE-2026-42584
Netty: HttpClientCodec response desynchronization
7.5
CVE-2026-42587
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
7.5
CVE-2026-42585
Netty: HTTP Request Smuggling due to malformed Transfer-Encoding