CVE-2026-42577CWE-772

Netty: epoll transport denial of service via RST on half-closed TCP connection

High · published May 13, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.1
In the wild
Unconfirmed
What it is

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00583 · 47.1th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-05-13T18:00Z
EPSS history
Timeline
  • 13 MAY 18:00Z
    Netty: epoll transport denial of service via RST on half-closed TCP connection
    cvelistv5