CVE-2026-42580

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.2.13.Final Netty versions prior to 4.1.133.Final

Description Netty's chunk size parser silently overflows an integer, which allows for request smuggling attacks. This occurs within the getChunkSize() function of the io.netty.handler.codec.http.HttpObjectDecoder class, where the size is accumulated by multiplying the result by 16 and adding the digit. Because the result is only checked for negative values, a carefully crafted chunk size can result in a valid size, enabling an attacker to inject arbitrary HTTP requests inside a chunked body.

Recommendations Update to version 4.2.13.Final. Update to version 4.1.133.Final.