CVE-2026-42584

EUVD-2026-30127
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
HTTP Request/Response Smuggling
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 51.76%
Affected Products (NVD)
VendorProductVersion
nettynetty
𝑥
< 4.1.133
nettynetty
4.2.0 ≤
𝑥
< 4.2.13
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatCryostat 4 on RHEL 9
4.2.0-10 ≤
𝑥
< *
ADP
Red HatRed Hat AMQ Broker 7.13.6
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat AMQ Broker 7.14.1
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat build of Quarkus 3.27.4
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.16.0-22.redhat_00057.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.3.14-11.SP11_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:1.5.26-2.Final_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.18.8-1.redhat_00003.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:5.0.31-3.SP2_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:1.10.0-46.Final_redhat_00044.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:4.1.135-1.Final_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.5.5-30.SP12_redhat_00020.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.5.5-24.SP12_redhat_00016.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:2.2.40-2.SP3_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
0:7.4.25-2.GA_redhat_00001.1.el7eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.16.0-22.redhat_00057.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.3.14-11.SP11_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:1.5.26-2.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.18.8-1.redhat_00003.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:5.0.31-3.SP2_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:1.10.0-46.Final_redhat_00044.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:4.1.135-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.5.5-30.SP12_redhat_00020.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.5.5-24.SP12_redhat_00016.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:2.2.40-1.SP3_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
0:7.4.25-2.GA_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.16.0-22.redhat_00057.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.3.14-11.SP11_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:1.5.26-2.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.18.8-1.redhat_00003.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:5.0.31-3.SP2_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:1.10.0-46.Final_redhat_00044.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:4.1.135-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.5.5-30.SP12_redhat_00020.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.5.5-24.SP12_redhat_00016.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:2.2.40-1.SP3_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
0:7.4.25-2.GA_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1.7.GA
4.1.135.Final-redhat-00001 ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
0:801.7.1-1.GA_redhat_00001.1.el10eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
0:4.1.135-1.Final_redhat_00001.1.el10eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
0:8.1.7.1-1.GA_redhat_00004.1.el10eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:801.7.1-1.GA_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:0.9.6-2.redhat_00002.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:4.1.135-1.Final_redhat_00001.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
0:8.1.7.1-1.GA_redhat_00004.1.el8eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:801.7.1-1.GA_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:0.9.6-2.redhat_00002.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:4.1.135-1.Final_redhat_00001.1.el9eap ≤
𝑥
< *
ADP
Red HatRed Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
0:8.1.7.1-1.GA_redhat_00004.1.el9eap ≤
𝑥
< *
ADP
Red HatStreams for Apache Kafka 3.2.1
codec-http ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1783443816 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift AI 2.25
1788198681 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780948325 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780696380 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.28
1780694994 ≤
𝑥
< *
ADP
Red HatRed Hat OpenShift Dev Spaces 3.29
1782989027 ≤
𝑥
< *
ADP
Debian logo
Debian Releases
Debian Product
Codename
netty
bookworm
vulnerable
bookworm (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
trixie (security)
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
netty
bionic
Fixed 1:4.1.7-4ubuntu0.1+esm6
released
focal
Fixed 1:4.1.45-1ubuntu0.1~esm6
released
jammy
Fixed 1:4.1.48-4+deb11u2ubuntu0.1+esm3
released
noble
Fixed 1:4.1.48-9ubuntu0.1+esm3
released
questing
ignored
resolute
Fixed 1:4.1.48-16ubuntu0.1~esm2
released
trusty
Fixed 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
released
xenial
Fixed 1:4.0.34-1ubuntu0.1~esm4
released
Common Weakness Enumeration
References
https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3
https://access.redhat.com/errata/RHSA-2026:23808
https://access.redhat.com/errata/RHSA-2026:24502
https://access.redhat.com/errata/RHSA-2026:25123
https://access.redhat.com/errata/RHSA-2026:28010
https://access.redhat.com/errata/RHSA-2026:36820
https://access.redhat.com/errata/RHSA-2026:37390
https://access.redhat.com/errata/RHSA-2026:42644
https://access.redhat.com/errata/RHSA-2026:49700
https://access.redhat.com/errata/RHSA-2026:49701
https://access.redhat.com/errata/RHSA-2026:53644
https://access.redhat.com/errata/RHSA-2026:53645
https://access.redhat.com/errata/RHSA-2026:53646
https://access.redhat.com/errata/RHSA-2026:54435
https://access.redhat.com/errata/RHSA-2026:65126
https://access.redhat.com/errata/RHSA-2026:66488
https://access.redhat.com/errata/RHSA-2026:66545
https://access.redhat.com/security/cve/CVE-2026-42584
https://bugzilla.redhat.com/show_bug.cgi?id=2477224
https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42584.json