Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2026-42580

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

VectorNETWORK

PublishedMay 13, 2026, 19:17

Published Bysecurity-advisories@github.com

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

io.netty:netty-codec-http(Maven)4.2.0.Alpha14.2.13.FinalN/A

io.netty:netty-codec-http(Maven)04.1.133.FinalN/A

References

https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723

Weakness Type

CWE-190

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK