PT-2026-38373 · Netty · Netty

Published 2026-05-07 · Updated 2026-06-24 · CVE-2026-42580

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.2.13.Final Netty versions prior to 4.1.133.Final

Description Netty's chunk size parser silently overflows an integer, which allows for request smuggling attacks. This occurs within the getChunkSize() function of the io.netty.handler.codec.http.HttpObjectDecoder class, where the size is accumulated by multiplying the result by 16 and adding the digit. Because the result is only checked for negative values, a carefully crafted chunk size can result in a valid size, enabling an attacker to inject arbitrary HTTP requests inside a chunked body.

Recommendations Update to version 4.2.13.Final. Update to version 4.1.133.Final.

Exploit

Fix

DoS

HTTP Request/Response Smuggling

Integer Overflow

Weakness Enumeration

CWE-444

CWE-190

Related Identifiers

CLEANSTART-2026-CP46043

CLEANSTART-2026-DD05788

CLEANSTART-2026-EG39405

CLEANSTART-2026-GX01236

CLEANSTART-2026-LE11246

CLEANSTART-2026-MX76059

CLEANSTART-2026-PM36304

CLEANSTART-2026-PO27799

CLEANSTART-2026-RN56220

CLEANSTART-2026-RU36468

CLEANSTART-2026-VJ37814

CVE-2026-42580

GHSA-M4CV-J2PX-7723

OPENSUSE-SU-2026:10795-1

SUSE-SU-2026:2308-1

Affected Products

Netty

References · 394

• 🔥 https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-23015 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68119 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42584 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52428 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-2976 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61729 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-44487 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-46120 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-LE11246 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12798 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42403 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Security Note