CVE-2026-42581 Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-42581?
CVE-2026-42581 is a medium-severity vulnerability in Netty Netty, published on 13 May 2026.
Official description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Weakness: CWE-444
Which versions are affected by CVE-2026-42581?
4 open source packages ship an affected version, including io.netty:netty-codec-http. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.netty:netty-codec-http Maven | All versions | 4.1.133.Final |
io.netty:netty-codec-http Maven | All versions | 4.1.133.Final |
io.netty:netty-codec-http Maven | From 4.2.0.Alpha1 | 4.2.13.Final |
io.netty:netty-codec-http Maven | From 4.2.0.Alpha1 | 4.2.13.Final |
Products include Netty Netty.
How do I fix CVE-2026-42581?
Upgrade io.netty:netty-codec-http to a fixed version for your release line: 4.1.133.Final or 4.2.13.Final.
Is CVE-2026-42581 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-42581 exists.
Other vulnerabilities in Netty Netty
- CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
- CVE-2026-75596 Netty: Fragmented ClientHello records trigger quadratic pre-handshake reassembly in default SNI parsing
- CVE-2026-59901 Netty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang
- CVE-2026-55851 Netty codec-haproxy: Signed-Byte Sentinel Collision in HAProxyMessageDecoder Leads to Unbounded Memory Exhaustion
- CVE-2026-56745 Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM Leads to Native Memory Exhaustion
Sources
Also known as CLEANSTART-2026-GO10860, CLEANSTART-2026-HJ71849, CLEANSTART-2026-IZ96145, CLEANSTART-2026-KP38688, CLEANSTART-2026-NR95500, CLEANSTART-2026-RK60048 and 104 more.