CVE-2026-42585 Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

🗓️ 13 May 2026 18:12:39Reported by GitHub_MType

Netty HTTP request smuggling from malformed Transfer-Encoding; fixed in 4.2.13.Final and 4.1.133.Final.

Reporter	Title	Published	Views	Family All 148
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains vulnerabilities related to use of netty-codec-http	19 May 202619:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty	21 May 202616:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	23 Jun 202619:50	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Netty, IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	11 Jun 202607:12	–	ibm
Atlassian	HTTP Request Smuggling io.netty:netty-codec-http Dependency in Bamboo Data Center	1 Jun 202622:30	–	atlassian
Atlassian	HTTP Request Smuggling io.netty:netty-codec-http Dependency in Confluence Data Center	2 Jun 202616:30	–	atlassian
Atlassian	HTTP Request Smuggling io.netty:netty-codec-http Dependency in Crowd Data Center	11 Jun 202617:31	–	atlassian
Atlassian	HTTP Request Smuggling io.netty:netty-codec-http Dependency in Jira Service Management Data Center	3 Jun 202616:30	–	atlassian
Atlassian	HTTP Request Smuggling io.netty:netty-codec-http Dependency in Jira Data Center	21 May 202619:29	–	atlassian
BDU FSTEC	The vulnerability of the netty-codec-http module in the framework for developing network applications, servers, and clients using the Netty protocol allows attackers to inject arbitrary HTTP requests.	16 Jul 202600:00	–	bdu_fstec

[
  {
    "vendor": "netty",
    "product": "netty",
    "versions": [
      {
        "version": ">= 4.2.0.Alpha1, < 4.2.13.Final",
        "status": "affected"
      },
      {
        "version": "< 4.1.133.Final",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "io.netty",
    "product": "netty-codec-http",
    "versions": [
      {
        "version": ">= 4.2.0.Alpha1, < 4.2.13.Final",
        "status": "affected"
      },
      {
        "version": "< 4.1.133.Final",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cv

13 May 2026 18:13Current

CVSS 3.16.5

EPSS0.00248

CWE-444