CVE-2026-42582

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw	Exploit Vendor Advisory
https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Netty es un framework de aplicación de red asíncrono y basado en eventos. Antes de la versión 4.2.13.Final, al decodificar bloques de cabecera, la rama no-Huffman de io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral puede ejecutar new byte[length] para un literal de cadena antes de verificar que ’length’ bytes estén realmente presentes en la sección de campo comprimido. La codificación en la red permite que una longitud muy grande se exprese en pocos bytes. No hay una comprobación de que length <= in.readableBytes() antes de new byte[length]. Esta vulnerabilidad se corrige en la versión 4.2.13.Final.

Information

Published : 2026-05-13 19:17

Updated : 2026-10-26 00:10

NVD link : CVE-2026-42582

Mitre link : CVE-2026-42582

CVE.ORG link : CVE-2026-42582

JSON object : View

Products Affected

netty

netty

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-42582", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42582", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T19:35:22.097676Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "netty", "product": "netty", "versions": [{"status": "affected", "version": ">= 4.2.0.Alpha1, < 4.2.13.Final"}]}, {"vendor": "io.netty", "product": "netty-codec-http3", "versions": [{"status": "affected", "version": ">= 4.2.0.Alpha1, < 4.2.13.Final"}]}]}], "published": "2026-05-13T19:17:23.763", "references": [{"url": "https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}, {"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final."}, {"lang": "es", "value": "Netty es un framework de aplicaci\u00f3n de red as\u00edncrono y basado en eventos. Antes de la versi\u00f3n 4.2.13.Final, al decodificar bloques de cabecera, la rama no-Huffman de io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral puede ejecutar new byte[length] para un literal de cadena antes de verificar que \u2019length\u2019 bytes est\u00e9n realmente presentes en la secci\u00f3n de campo comprimido. La codificaci\u00f3n en la red permite que una longitud muy grande se exprese en pocos bytes. No hay una comprobaci\u00f3n de que length <= in.readableBytes() antes de new byte[length]. Esta vulnerabilidad se corrige en la versi\u00f3n 4.2.13.Final."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D94A720F-9CED-4BE9-8C37-FD9E2FD28472", "versionEndExcluding": "4.2.13", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}