Skip to content
OpenAdvisories
Medium WID-SEC-2026-1372 13 CVEs

Netty: Mehrere Schwachstellen

Published May 5, 2026 · Updated Oct 15, 2026 · Revision 29 · de-DE

Vendor: Absolute Software Vendor: IBM Vendor: Red Hat Vendor: SUSE Vendor: Ubuntu Product: Cognos Analytics Product: Db2 Product: Enterprise Linux Product: JBoss Enterprise Application Platform Product: Linux Product: Linux Product: Planning Analytics Product: Secure Access Product: SPSS Product: Storage Scale

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Netty ist ein asynchrones, ereignisgesteuertes Netzwerk-Anwendungs-Framework für die schnelle Entwicklung von wartbaren, hochleistungsfähigen Protokollservern und -clients.

Vulnerabilities 13

  • High 7.5
    CVE-2026-42577

    Netty: epoll transport denial of service via RST on half-closed TCP connection

    Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cle…

    netty netty druid thingsboard-tb-node Debian Wolfi Maven
  • High 7.5
    CVE-2026-42579

    Netty: DNS Codec Input Validation Bypass in Netty (Encoder + Decoder)

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface:…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2026-42582

    Netty: HTTP/3 QPACK literal unbounded allocation

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string…

    netty io.netty netty netty-codec-http3 Debian Wolfi Maven
  • High 7.5
    CVE-2026-42583

    Netty: Lz4FrameDecoder resource exhaustion

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus comp…

    netty io.netty netty netty-codec Debian Wolfi Maven
  • High 7.5
    CVE-2026-42587

    Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is c…

    netty io.netty netty netty-codec-http Debian Wolfi Maven
  • High 7.3
    CVE-2026-42584

    Netty: HttpClientCodec response desynchronization

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines G…

    netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  • Medium 6.8
    CVE-2026-42586

    Netty: CRLF Injection in Netty Redis Codec Encoder

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanit…

    netty io.netty netty netty-codec-redis Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2026-42580

    Netty: HTTP Request Smuggling due to incorrect chunk size parsing

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

    netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2026-42585

    Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Fi…

    netty io.netty netty netty-codec-http Debian Ubuntu Wolfi Maven
  • Medium 5.8
    CVE-2026-42581

    Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-41417

    Netty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()

    Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, b…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-44248

    Netty: Resource exhaustion in MqttDecoder

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariab…

    netty io.netty netty netty-codec-mqtt Debian Wolfi Maven
  • Low 2.9
    CVE-2026-42578

    Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

    Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers…

    netty netty druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Revision history

  1. #29

    Neue Updates von IBM aufgenommen

  2. #28

    Neue Updates aufgenommen

  3. #27

    Neue Updates von IBM aufgenommen

  4. #26

    Neue Updates von Red Hat aufgenommen

  5. #25

    Neue Updates von Red Hat aufgenommen

  6. #24

    Neue Updates von Red Hat aufgenommen

  7. #23

    Neue Updates von IBM aufgenommen

  8. #22

    Neue Updates von Red Hat aufgenommen

  9. #21

    Neue Updates von IBM aufgenommen

  10. #20

    Neue Updates von Red Hat aufgenommen

  11. #19

    Neue Updates von Red Hat aufgenommen

  12. #18

    Neue Updates von IBM aufgenommen

  13. #17

    Neue Updates von Red Hat aufgenommen

  14. #16

    Neue Updates von IBM aufgenommen

  15. #15

    Neue Updates von Red Hat aufgenommen

  16. #14

    Neue Updates von IBM aufgenommen

  17. #13

    Neue Updates von Red Hat aufgenommen

  18. #12

    Neue Updates von Red Hat aufgenommen

  19. #11

    Neue Updates von Red Hat aufgenommen

  20. #10

    Neue Updates von IBM aufgenommen

  21. #9

    Neue Updates von IBM aufgenommen

  22. #8

    Neue Updates von Red Hat aufgenommen

  23. #7

    Neue Updates von Red Hat aufgenommen

  24. #6

    Neue Updates von SUSE aufgenommen

  25. #5

    Neue Updates von Ubuntu aufgenommen

References