PT-2026-38375 · Netty+1 · Netty+1

CVE-2026-42582 · Published 2026-05-04 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.2.13.Final

Description When decoding HTTP/3 header blocks, the non-Huffman branch of the decodeHuffmanEncodedLiteral() function in io.netty.handler.codec.http3.QpackDecoder may execute new byte[length] for a string literal before verifying that the specified length of bytes is actually present in the compressed field section. Because the wire encoding allows a very large length to be expressed in few bytes, a small malicious header can claim a huge length, potentially causing the server to slow down, stall, or crash due to very large memory allocations.

Recommendations Update to version 4.2.13.Final.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-789

CWE-770

Related Identifiers

BDU:2026-09996

CLEANSTART-2026-DT81884

CLEANSTART-2026-EG39405

CLEANSTART-2026-GX44743

CVE-2026-42582

GHSA-2C5C-CHWR-9HQW

OPENSUSE-SU-2026:10795-1

SUSE-SU-2026:2308-1

Affected Products

Netty

Red Os

References · 131

• 🔥 https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42582.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42581 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-DT81884 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67721 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61731 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:2308-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61726 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42584 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44894 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-42582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42585 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42504 · Security Note