CVE-2026-42583 Netty: Lz4FrameDecoder resource exhaustion

🗓️ 13 May 2026 18:09:19Reported by GitHub_MType

Netty Lz4FrameDecoder may exhaust memory by preallocating up to 32 MB per block; fixed in 4.2.13.Final and 4.1.133.Final.

Reporter	Title	Published	Views	Family All 236
IBM Security Bulletins	Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image	27 May 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	16 Jun 202616:25	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	26 Jun 202606:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	23 Jun 202619:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is affected by Uncontrolled Resource Consumption.	15 Jun 202619:19	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Netty affects IBM Netezza Appliance	7 Aug 202612:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in netty-codec-4.1.129.Final.jar	30 Jun 202611:10	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	27 May 202616:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the netty-codec library that could allow a remote attacker to trigger excessive memory allocation by sending specially crafted LZ4-compressed data. (CVE-2026-42583).	3 Aug 202608:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Aug 202614:48	–	ibm

[
  {
    "vendor": "netty",
    "product": "netty",
    "versions": [
      {
        "version": ">= 4.2.0.Alpha1, < 4.2.13.Final",
        "status": "affected"
      },
      {
        "version": "< 4.1.133.Final",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "io.netty",
    "product": "netty-codec",
    "versions": [
      {
        "version": "< 4.1.133.Final",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "io.netty",
    "product": "netty-codec-compression",
    "versions": [
      {
        "version": "< 4.2.13.Final",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6

13 May 2026 18:09Current

CVSS 3.17.5

EPSS0.00429