CVE-2026-42584 Netty CVE debrief

Who should care

Teams that use Netty as an HTTP client, especially where request pipelining is enabled or possible. Security and platform engineers should prioritize services that can issue mixed request methods such as GET and HEAD over the same connection, since the issue is triggered by response/request pairing under pipelined traffic.

Technical summary

According to the CVE description and the linked Netty advisory, HttpClientCodec advances its outbound request queue once per inbound response, including 1xx informational responses. In the reported sequence, a 103 interim response consumes a queue entry, leading the later 200 response to be associated with the wrong request. Because the request is interpreted as HEAD, body consumption is skipped, which leaves unread bytes from the prior GET response on the stream. Subsequent parsing then starts at the wrong offset, producing HTTP message desynchronization. The vulnerable version ranges in the official record end before 4.1.133.Final and before 4.2.13.Final.

Defensive priority

High. This is a network-reachable parsing flaw with no privileges or user interaction required, and it can disrupt HTTP message integrity across a client connection. Prioritize patching internet-facing or high-value services that use Netty HTTP client pipelining, then validate that no affected versions remain in production or embedded dependencies.

Recommended defensive actions

• Upgrade Netty to 4.1.133.Final or later, or to 4.2.13.Final or later, as applicable to your release line.
• Audit applications and libraries for transitive Netty dependencies so older vulnerable versions are not reintroduced indirectly.
• Review client code paths that pipeline HTTP requests, especially mixed-method sequences involving GET and HEAD.
• If immediate upgrade is not possible, reduce exposure by avoiding pipelined HTTP/1.1 request patterns on affected clients until remediation is complete.
• Add dependency and runtime checks in CI/CD and asset inventory processes to flag affected Netty versions.

Evidence notes

The CVE record was published on 2026-05-13 and modified on 2026-05-18. The official NVD record marks the issue as analyzed and maps affected versions to Netty before 4.1.133 and before 4.2.13. The linked GitHub Security Advisory is the vendor advisory referenced by NVD and is the primary source for the described response-pairing behavior and fix ranges. No KEV entry was provided in the supplied corpus.

Official resources