PT-2026-38376 · Netty+3 · Netty+3

Published 2026-05-07 · Updated 2026-06-16 · CVE-2026-42584

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.2.13.Final Netty versions prior to 4.1.133.Final

Description In the HttpClientCodec, inbound responses are paired with outbound requests using queue.poll() once per response, including for 1xx responses. When HTTP/1.1 pipelining is used and a HEAD request is included in the pipeline, a server sending a 103 response followed by a 200 response with a GET body and another 200 for HEAD can cause the queue to incorrectly pair the HEAD request with the first 200 response. Because the HEAD rule skips reading the message body, the GET entity bytes remain on the stream, causing the subsequent 200 response to be parsed from an incorrect offset. This affects the integrity and availability of HTTP parsing on the connection and leads to unsafe socket reuse.

Recommendations Update to version 4.2.13.Final. Update to version 4.1.133.Final.

Exploit

Fix

DoS

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CLEANSTART-2026-CP46043

CLEANSTART-2026-DD05788

CLEANSTART-2026-EG39405

CLEANSTART-2026-GX01236

CLEANSTART-2026-LE11246

CLEANSTART-2026-MX76059

CLEANSTART-2026-PM36304

CLEANSTART-2026-PO27799

CLEANSTART-2026-RN56220

CLEANSTART-2026-RU36468

CLEANSTART-2026-VJ37814

CVE-2026-42584

GHSA-57RV-R2G8-2CJ3

OPENSUSE-SU-2026:10795-1

SUSE-SU-2026:2308-1

USN-8401-1

Affected Products

Confluence

Linuxmint

Netty

Ubuntu

References · 402

• 🔥 https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3 · Exploit
• https://osv.dev/vulnerability/CLEANSTART-2026-VJ37814 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0341 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-11798 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33870 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61728 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42582 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-1320 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-3509 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-45536 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-GX01236 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-42584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1002 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-DD05788 · Vendor Advisory