CVE-2026-42587 Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

🗓️ 13 May 2026 18:22:21Reported by GitHub_MType

Netty decompress limit bypass for brotli, zstandard, snappy causes denial of service.

Reporter	Title	Published	Views	Family All 186
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains vulnerabilities related to use of netty-codec-http	19 May 202619:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	25 Jun 202617:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty	21 May 202616:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	23 Jun 202619:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:27	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Netty, IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	11 Jun 202607:12	–	ibm
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Bamboo Data Center	1 Jun 202622:29	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec-http2 Dependency in Crowd Data Center	12 Jun 202611:29	–	atlassian
Atlassian	DoS (Denial of Service) io.netty:netty-codec Dependency in Jira Service Management Data Center	3 Jun 202616:29	–	atlassian
BDU FSTEC	The vulnerability of the decompression mechanism used by frameworks for developing network applications, servers, and client protocols via Netty allows a hacker to induce a service failure.	16 Jul 202600:00	–	bdu_fstec

[
  {
    "vendor": "netty",
    "product": "netty",
    "versions": [
      {
        "version": ">= 4.2.0.Alpha1, < 4.2.13.Final",
        "status": "affected"
      },
      {
        "version": "< 4.1.133.Final",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "io.netty",
    "product": "netty-codec-http",
    "versions": [
      {
        "version": ">= 4.2.0.Alpha1, < 4.2.13.Final",
        "status": "affected"
      },
      {
        "version": "< 4.1.133.Final",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "io.netty",
    "product": "netty-codec-http2",
    "versions": [
      {
        "version": ">= 4.2.0.Alpha1, < 4.2.13.Final",
        "status": "affected"
      },
      {
        "version": "< 4.1.133.Final",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv

13 May 2026 18:22Current

CVSS 3.17.5

EPSS0.0099

CWE-400