PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42580 Netty CVE debrief

Netty's HTTP chunk size parser contains an integer overflow vulnerability that enables HTTP request smuggling attacks. The flaw occurs when parsing chunked transfer-encoding sizes, where a malformed chunk size value silently overflows the signed 32-bit integer type, causing Netty to misinterpret chunk boundaries. This can desynchronize the HTTP request/response stream between Netty-based servers and downstream components, potentially allowing attackers to smuggle malicious requests past security controls. The vulnerability affects Netty versions prior to 4.1.133.Final in the 4.1.x branch and prior to 4.2.13.Final in the 4.2.x branch. The issue was disclosed on 2026-05-13 and last modified on 2026-05-18. No known exploitation in ransomware campaigns has been reported.

Vendor
Netty
Product
Netty
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-05-18
Advisory published
2026-05-13
Advisory updated
2026-05-18

Who should care

Organizations running Netty-based HTTP servers or proxies, particularly those handling untrusted client traffic directly or behind load balancers. Development teams using Netty for custom protocol implementations with chunked encoding support.

Technical summary

The vulnerability resides in Netty's HTTP decoder when parsing chunked transfer-encoding chunk sizes. A maliciously crafted chunk size value exceeding Integer.MAX_VALUE causes silent integer overflow, resulting in a negative or truncated size value. This boundary miscalculation desynchronizes the HTTP message parser state, enabling request smuggling where subsequent bytes are interpreted as a new HTTP request rather than chunk data. The attack requires network access to the target application but no authentication. Impact is limited to integrity and availability (no confidentiality impact per CVSS).

Defensive priority

medium

Recommended defensive actions

  • Upgrade Netty to version 4.1.133.Final or later for the 4.1.x branch, or 4.2.13.Final or later for the 4.2.x branch
  • Review application logs for anomalous HTTP chunked transfer-encoding requests that may indicate exploitation attempts
  • Implement defense-in-depth by deploying HTTP request smuggling detection at load balancers or reverse proxies fronting Netty applications
  • Validate that upstream security controls (WAFs, API gateways) properly normalize chunked encoding to prevent smuggling variants
  • Audit custom Netty channel handlers for additional integer overflow risks in length or size parsing logic

Evidence notes

Integer overflow in chunk size parsing (CWE-190) leading to HTTP request smuggling (CWE-444). CVSS 3.1 score 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. Affected versions confirmed via NVD CPE criteria: all versions before 4.1.133.Final and 4.2.0 through 4.2.12.Final.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42580 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42580

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42580 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42580

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.