CVE-2026-42580

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2026-05-13

Updated

2026-05-14

Proof-of-concept exploits (1)

• advisories/GHSA-m4cv-j2px-7723

References

• CVE Record
• NVD entry

Related

• CVE-2026-42579
• CVE-2026-42581
• CVE-2026-42578
• CVE-2026-42582
• CVE-2026-4257
• CVE-2026-42583