CVE-2026-42587 Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate...

PT-2025-5639

Name of the Vulnerable Software and Affected Versions: Lodestar affected versions not specified Description: The issue affects the Lodestar implementation of the ssz snappy encoding protocol, where the checksum in snappy framing uncompressed chunks is not verified. This can lead to unintended...