CVE-2026-42584 Netty CVE debrief

Who should care

Defenders responsible for systems using Netty should assess their exposure to this vulnerability. This includes developers and administrators who work with network applications built on Netty, especially those that use pipelining in their HTTP requests.

Why it matters

CVE-2026-42584 is a vulnerability in Netty's HttpClientCodec that can cause incorrect pairing of HTTP responses with requests, potentially leading to misinterpretation of message bodies. Defenders should prioritize updating to fixed versions and verifying the versions in use.

• Incorrect parsing of HTTP message bodies can lead to unintended behavior in applications using Netty
• Potential for information disclosure or request smuggling due to misinterpretation of HTTP responses
• Necessity to verify version numbers of Netty in use and apply patches or updates
• Possible impact on the security posture of systems relying on Netty for network communication

Technical summary

The HttpClientCodec in Netty, prior to versions 4.2.13.Final and 4.1.133.Final, has a vulnerability that can cause incorrect pairing of HTTP responses with requests when pipelining is used. This can lead to misinterpretation of HTTP message bodies. Defenders should prioritize updating Netty to fixed versions and verify the versions in use. The vulnerability arises when a client sends a GET request followed by a HEAD request, and the server responds with a 103 status code, then a 200 status code with a GET body, and finally another 200 status code for the HEAD request. In such a scenario, the codec may pair the HEAD request with the first 200 status code, causing it to skip reading the message body of the HEAD

Defensive priority

Defenders should prioritize updating Netty to versions 4.2.13.Final or 4.1.133.Final, or later, to mitigate this vulnerability. Additionally, defenders should review their systems for any instances of Netty being used and verify that the versions in use are not vulnerable.

Recommended defensive actions

• Update Netty to version 4.2.13.Final or 4.1.133.Final, or later
• Review systems for instances of Netty and verify version numbers
• Apply patches provided by Red Hat for affected systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail provide information about the vulnerability, its impact, and the affected versions of Netty. The vendor advisory from GitHub and Red Hat errata also offer insights into the issue and provide patches for affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.