Log in Start free

Vulnerability · Published May 13, 2026 · Assigned by GitHub_M

CVE-2026-42584Netty: HttpClientCodec response desynchronization

High 7.3

In plain English

A high-severity security flaw in netty-codec-http from io.netty. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.8%top 42.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12nettyno fix listedDEBIAN-CVE-2026-42584
Debian:13nettyno fix listedDEBIAN-CVE-2026-42584
Debian:14nettyno fix listedDEBIAN-CVE-2026-42584
Mavenio.netty:netty-codec-http4.1.133.FinalGHSA-57rv-r2g8-2cj3
Mavenio.netty:netty-codec-http4.2.13.FinalGHSA-57rv-r2g8-2cj3
Ubuntu:25.10nettyno fix listedUBUNTU-CVE-2026-42584
Ubuntu:26.10nettyno fix listedUBUNTU-CVE-2026-42584

Affected products (as reported)

VendorProductVersions
netty netty >= 4.2.0.Alpha1, < 4.2.13.Final< 4.1.133.Final
io.netty netty-codec-http >= 4.2.0.Alpha1, < 4.2.13.Final< 4.1.133.Final

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References