PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42583 Netty CVE debrief

Netty's Lz4FrameDecoder contains an uncontrolled resource consumption vulnerability (CWE-400/CWE-770) that allows remote attackers to trigger excessive memory allocation. The decoder allocates a ByteBuf sized to the attacker-supplied decompressedLength (up to 32 MB per block) before any LZ4 decompression occurs. A malicious peer can force this allocation with only 21-22 bytes of network traffic, making this an efficient denial-of-service vector. The vulnerability affects Netty versions prior to 4.1.133.Final and 4.2.13.Final. The CVSS 3.1 score of 7.5 (HIGH) reflects network attackability, low complexity, no privileges required, and high availability impact.

Vendor
Netty
Product
netty
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-13
Original CVE updated
2026-05-18
Advisory published
2026-05-13
Advisory updated
2026-05-18

Who should care

Organizations running Netty-based applications with LZ4 compression enabled, particularly those exposed to untrusted network traffic. This includes API gateways, proxy services, messaging systems, and any custom network applications built on Netty that may process LZ4-compressed data from external sources.

Technical summary

The Lz4FrameDecoder in Netty versions before 4.1.133.Final and 4.2.13.Final performs insufficient validation of the decompressedLength field in LZ4 frame headers. This field is a 32-bit unsigned integer that can specify up to approximately 32 MB per block. The decoder allocates a ByteBuf of this size immediately upon parsing the header, before any decompression occurs. An attacker can craft a minimal 21-byte LZ4 frame header (22 bytes if compressedLength equals 1) with a large decompressedLength value to force excessive memory allocation. This represents an asymmetric resource consumption attack where minimal attacker input causes disproportionate server resource exhaustion. The vulnerability is remotely exploitable without authentication and requires no user interaction.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Netty to 4.1.133.Final or 4.2.13.Final or later
  • If immediate patching is not possible, disable or restrict LZ4 compression frame handling in untrusted network contexts
  • Monitor for unusual memory allocation patterns in applications using Netty's LZ4 codec
  • Review network exposure of services using Netty's Lz4FrameDecoder, particularly those accessible from untrusted networks

Evidence notes

CVE published 2026-05-13; NVD entry modified 2026-05-18. Vendor advisory confirms exploitability and fixed versions. CPE criteria specify affected version ranges: all versions below 4.1.133.Final, and 4.2.x versions below 4.2.13.Final.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42583 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42583

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42583 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42583

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.