CVE-2026-42580 Netty: HTTP Request Smuggling due to incorrect chunk size parsing

🗓️ 13 May 2026 18:04:03Reported by GoogleType

osv🔗 osv.dev👁 1 Views

CVE-2026-42580: Netty HTTP request smuggling from chunk size overflow fixed in four point two thirteen final and four one one three final.

Reporter	Title	Published	Views	Family All 139
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains vulnerabilities related to use of netty-codec-http	19 May 202619:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Netty	21 May 202616:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM® Db2® federated server is affected by multiple vulnerabilities in Netty open source libraries.	23 Jun 202619:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Local is affected by security vulnerabilities	9 Jul 202614:00	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Netty, IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	11 Jun 202607:12	–	ibm
BDU FSTEC	The vulnerability of the HTTP traffic processing component of the framework for developing network applications, servers, and client protocols using Netty allows attackers to perform spoofing attacks.	6 Jul 202600:00	–	bdu_fstec
Chainguard	CVE-2026-42580 vulnerabilities	8 May 202601:17	–	cgr
Circl	CVE-2026-42580	5 May 202618:09	–	circl
CNNVD	Netty 输入验证错误漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-42580	13 May 202618:04	–	cve

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42580.json
github	www.github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42580

15 Jul 2026 01:49Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.16.5

EPSS0.00364