CVE-2026-42581Medium· 5.8▾ TwilightPoC availableNetty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Conten…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 31.9 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.6%
0.6% → 0.6%
Exploit / PoC code exists
Last analysed / modified upstream
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
netty < 4.1.133netty >= 4.2.0, < 4.2.13Upgrade past the affected range:
netty 4.2.13Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-42584High· 7.3Netty is an asynchronous, event-driven network application framework
CVE-2026-42579High· 7.5Netty is an asynchronous, event-driven network application framework
CVE-2026-42578High· 7.5Netty is an asynchronous, event-driven network application framework
CVE-2026-50011High· 7.5Netty is a network application framework for development of protocol servers and clients
CVE-2026-45674High· 8.7Netty is a network application framework for development of protocol servers and clients
CVE-2026-33870High· 7.5Netty is an asynchronous, event-driven network application framework