CVE-2026-42581

EUVD-2026-30124
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
HTTP Request/Response Smuggling
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 50.51%
Affected Products (NVD)
VendorProductVersion
nettynetty
𝑥
< 4.1.133
nettynetty
4.2.0 ≤
𝑥
< 4.2.13
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatCryostat 4 on RHEL 9
4.2.0-10 ≤
𝑥
< *
ADP
Red HatRed Hat AMQ Broker 7.13.6
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat AMQ Broker 7.14.1
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat build of Quarkus 3.27.4
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.16.0-22.redhat_00057.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.3.14-11.SP11_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:1.5.26-2.Final_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.18.8-1.redhat_00003.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:5.0.31-3.SP2_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:1.10.0-46.Final_redhat_00044.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:4.1.135-1.Final_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.5.5-30.SP12_redhat_00020.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.5.5-24.SP12_redhat_00016.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.2.40-2.SP3_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:7.4.25-2.GA_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.16.0-22.redhat_00057.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.3.14-11.SP11_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:1.5.26-2.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.18.8-1.redhat_00003.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:5.0.31-3.SP2_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:1.10.0-46.Final_redhat_00044.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:4.1.135-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.5.5-30.SP12_redhat_00020.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.5.5-24.SP12_redhat_00016.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.2.40-1.SP3_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:7.4.25-2.GA_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.16.0-22.redhat_00057.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.3.14-11.SP11_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:1.5.26-2.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.18.8-1.redhat_00003.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:5.0.31-3.SP2_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:1.10.0-46.Final_redhat_00044.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:4.1.135-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.5.5-30.SP12_redhat_00020.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.5.5-24.SP12_redhat_00016.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.2.40-1.SP3_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:7.4.25-2.GA_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1.7.GA
4.1.135.Final-redhat-00001 ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
0:801.7.1-1.GA_redhat_00001.1.el10eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
0:4.1.135-1.Final_redhat_00001.1.el10eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
0:8.1.7.1-1.GA_redhat_00004.1.el10eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:801.7.1-1.GA_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:0.9.6-2.redhat_00002.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:4.1.135-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:8.1.7.1-1.GA_redhat_00004.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:801.7.1-1.GA_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:0.9.6-2.redhat_00002.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:4.1.135-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:8.1.7.1-1.GA_redhat_00004.1.el9eap ≤
𝑥
< *
ADP
Red HatStreams for Apache Kafka 3.2.1
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1783443816 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1788198681 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780948325 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780696380 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780694994 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.29
1782989027 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
netty
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
netty
bionic
Fixed 1:4.1.7-4ubuntu0.1+esm6
released
focal
Fixed 1:4.1.45-1ubuntu0.1~esm6
released
jammy
Fixed 1:4.1.48-4+deb11u2ubuntu0.1+esm3
released
noble
Fixed 1:4.1.48-9ubuntu0.1+esm3
released
questing
ignored
resolute
Fixed 1:4.1.48-16ubuntu0.1~esm2
released
trusty
Fixed 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
released
xenial
Fixed 1:4.0.34-1ubuntu0.1~esm4
released
Common Weakness Enumeration
References
https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9
https://access.redhat.com/errata/RHSA-2026:23808
https://access.redhat.com/errata/RHSA-2026:24502
https://access.redhat.com/errata/RHSA-2026:25123
https://access.redhat.com/errata/RHSA-2026:28010
https://access.redhat.com/errata/RHSA-2026:36820
https://access.redhat.com/errata/RHSA-2026:37390
https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/errata/RHSA-2026:49700
https://access.redhat.com/errata/RHSA-2026:49701
https://access.redhat.com/errata/RHSA-2026:53644
https://access.redhat.com/errata/RHSA-2026:53645
https://access.redhat.com/errata/RHSA-2026:53646
https://access.redhat.com/errata/RHSA-2026:54435
https://access.redhat.com/errata/RHSA-2026:65126
https://access.redhat.com/errata/RHSA-2026:66488
https://access.redhat.com/errata/RHSA-2026:66545
https://access.redhat.com/security/cve/CVE-2026-42581
https://bugzilla.redhat.com/show_bug.cgi?id=2477232
https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42581.json