PT-2026-38280

🗓️ 06 May 2026 00:00:00Reported by Positive TechnologiesType

Netty epoll transport fails to close half-closed connections receiving RST, causing stale channels and CPU spin.

Reporter	Title	Published	Views	Family All 71
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty	27 May 202605:11	–	ibm
Chainguard	CVE-2026-42577 vulnerabilities	8 May 202601:17	–	cgr
CNNVD	Netty 安全漏洞	13 May 202600:00	–	cnnvd
CVE	CVE-2026-42577	13 May 202618:00	–	cve
Cvelist	CVE-2026-42577 Netty: epoll transport denial of service via RST on half-closed TCP connection	13 May 202618:00	–	cvelist
Debian CVE	CVE-2026-42577	13 May 202618:00	–	debiancve
Github Security Blog	Netty epoll transport denial of service via RST on half-closed TCP connection	6 May 202623:10	–	github
NVD	CVE-2026-42577	13 May 202619:17	–	nvd
OSV	CGA-PCRM-JRQ4-V7HW	7 May 202616:47	–	osv
OSV	CLEANSTART-2026-AO61361 Security fixes for CVE-2024-6763, CVE-2025-11143, CVE-2025-12183, CVE-2025-12383, CVE-2025-66566, CVE-2025-67030, CVE-2026-1605, CVE-2026-24281, CVE-2026-24308, CVE-2026-42577, CVE-2026-42583, ghsa-355h-qmc2-wpwf, ghsa-3pxv-7cmr-fjr4, ghsa-445c-vh5m-36rj, ghsa-6fmv-xxpf-w3cw, ghsa-6hg6-v5c8-fphq, ghsa-72hv-8253-57qq, ghsa-7xrh-hqfc-g7qr, ghsa-crhr-qqj8-rpxc, ghsa-mj4r-2hfc-f8p6, ghsa-qh8g-58pp-2wxh, ghsa-rwm7-x88c-3g2p, ghsa-wjpw-4j6x-6rwh applied in versions: 3.8.1-r10, 3.8.1-r11, 3.8.1-r5, 3.8.1-r6, 3.8.1-r7, 3.8.1-r8, 3.8.1-r9	18 May 202613:03	–	osv

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-42577
github	www.github.com/netty/netty/commit/0ec3d97fab376e243d328ac95fbd288ba0f6e22d
github	www.github.com/netty/netty/security/advisories/GHSA-rwm7-x88c-3g2p
osv	www.osv.dev/vulnerability/GHSA-rwm7-x88c-3g2p
github	www.github.com/netty/netty/pull/16689
github	www.github.com/netty/netty
t	www.t.me/cveNotify/163853

18 May 2026 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00051

SSVC