CVE-2026-42580CWE-190CWE-444

Netty: HTTP Request Smuggling due to incorrect chunk size parsing

Medium · published May 13, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
28.9
In the wild
Unconfirmed
What it is

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00362 · 28.9th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2026-05-13T18:04Z
EPSS history
Timeline
  • 13 MAY 18:04Z
    Netty: HTTP Request Smuggling due to incorrect chunk size parsing
    cvelistv5