CVE-2026-42587 Netty CVE debrief

Who should care

Organizations running Netty-based applications that handle HTTP request decompression, particularly those exposed to untrusted network traffic or operating with memory-constrained environments. This includes users of Netty directly as well as frameworks built on Netty such as Spring WebFlux, Vert.x, and various microservice gateways.

Technical summary

The vulnerability exists in Netty's decompression handlers where the maxAllocation parameter, intended to prevent decompression bomb attacks, is not propagated to Brotli, zstd, and snappy decoders. While gzip and deflate encodings properly respect this limit through ZlibDecoder, alternative encodings bypass the safeguard entirely. This affects both HTTP/1.1 (HttpContentDecompressor) and HTTP/2 (DelegatingDecompressorFrameListener) code paths. An attacker can exploit this by crafting compressed payloads with Content-Encoding: br (or zstd/snappy) that expand to sizes far exceeding configured limits, causing unbounded memory allocation and service disruption through out-of-memory conditions.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade Netty to version 4.1.133.Final or 4.2.13.Final or later, which enforce maxAllocation limits across all supported compression encodings.
• If immediate patching is not feasible, implement network-level controls to inspect and potentially block or rate-limit requests with Content-Encoding: br, zstd, or snappy headers until the application layer can be remed.
• Review application configurations to ensure maxAllocation parameters are explicitly set to appropriate values for your deployment's memory constraints.
• Monitor for anomalous memory consumption patterns in services handling decompressed HTTP content, particularly those exposed to untrusted network traffic.
• For HTTP/2 deployments, verify that DelegatingDecompressorFrameListener configurations are updated alongside HttpContentDecompressor changes.

Evidence notes

The CVE description and NVD record confirm that the maxAllocation parameter is correctly enforced for gzip and deflate via ZlibDecoder but silently ignored for br, zstd, and snappy encodings. The GitHub Security Advisory is tagged as containing exploit details and mitigation guidance. CVSS 3.1 score of 7.5 (HIGH) reflects network attack vector, low complexity, no privileges required, and high availability impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.