Skip to content
Fencer Vulns
high 7.2

CVE-2026-42581 json

Netty: HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

published 2026-05-07 6 mo ago modified 2026-09-18 52 d ago also EUVD-2026-30124 , GHSA-xxqh-mfjm-7mv9

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Patch / fix

  • maven io.netty:netty-codec-http 4.1.133.Final, 4.2.13.Final
  • Red Hat Cryostat 4 on RHEL 9 4.2.0-10
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:1.5.26-2.Final_redhat_00001.1.el7eap, 0:1.10.0-46.Final_redhat_00044.1.el7eap, 0:2.2.40-2.SP3_redhat_00001.1.el7eap, 0:2.3.14-11.SP11_redhat_00001.1.el7eap, 0:2.5.5-24.SP12_redhat_00016.1.el7eap, 0:2.5.5-30.SP12_redhat_00020.1.el7eap, 0:2.16.0-22.redhat_00057.1.el7eap, 0:2.18.8-1.redhat_00003.1.el7eap, 0:4.1.135-1.Final_redhat_00001.1.el7eap, 0:5.0.31-3.SP2_redhat_00001.1.el7eap, 0:7.4.25-2.GA_redhat_00001.1.el7eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 0:1.5.26-2.Final_redhat_00001.1.el8eap, 0:1.10.0-46.Final_redhat_00044.1.el8eap, 0:2.2.40-1.SP3_redhat_00001.1.el8eap, 0:2.3.14-11.SP11_redhat_00001.1.el8eap, 0:2.5.5-24.SP12_redhat_00016.1.el8eap, 0:2.5.5-30.SP12_redhat_00020.1.el8eap, 0:2.16.0-22.redhat_00057.1.el8eap, 0:2.18.8-1.redhat_00003.1.el8eap, 0:4.1.135-1.Final_redhat_00001.1.el8eap, 0:5.0.31-3.SP2_redhat_00001.1.el8eap, 0:7.4.25-2.GA_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 0:1.5.26-2.Final_redhat_00001.1.el9eap, 0:1.10.0-46.Final_redhat_00044.1.el9eap, 0:2.2.40-1.SP3_redhat_00001.1.el9eap, 0:2.3.14-11.SP11_redhat_00001.1.el9eap, 0:2.5.5-24.SP12_redhat_00016.1.el9eap, 0:2.5.5-30.SP12_redhat_00020.1.el9eap, 0:2.16.0-22.redhat_00057.1.el9eap, 0:2.18.8-1.redhat_00003.1.el9eap, 0:4.1.135-1.Final_redhat_00001.1.el9eap, 0:5.0.31-3.SP2_redhat_00001.1.el9eap, 0:7.4.25-2.GA_redhat_00001.1.el9eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA 4.1.135.Final-redhat-00001
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 0:4.1.135-1.Final_redhat_00001.1.el10eap, 0:8.1.7.1-1.GA_redhat_00004.1.el10eap, 0:801.7.1-1.GA_redhat_00001.1.el10eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:0.9.6-2.redhat_00002.1.el8eap, 0:4.1.135-1.Final_redhat_00001.1.el8eap, 0:8.1.7.1-1.GA_redhat_00004.1.el8eap, 0:801.7.1-1.GA_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:0.9.6-2.redhat_00002.1.el9eap, 0:4.1.135-1.Final_redhat_00001.1.el9eap, 0:8.1.7.1-1.GA_redhat_00004.1.el9eap, 0:801.7.1-1.GA_redhat_00001.1.el9eap
  • Red Hat Red Hat OpenShift AI 2.25 1783443816, 1788198681
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 1780694994, 1780696380, 1780948325
  • Red Hat Red Hat OpenShift Dev Spaces 3.29 1782989027
  • netty Ubuntu Pro 14.04 LTS 1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1
  • netty Ubuntu Pro 16.04 LTS 1:4.0.34-1ubuntu0.1~esm4
  • netty Ubuntu Pro 18.04 LTS 1:4.1.7-4ubuntu0.1+esm6
  • netty Ubuntu Pro 20.04 LTS 1:4.1.45-1ubuntu0.1~esm6
  • netty Ubuntu Pro 22.04 LTS 1:4.1.48-4+deb11u2ubuntu0.1+esm3
  • netty Ubuntu Pro 24.04 LTS 1:4.1.48-9ubuntu0.1+esm3
  • netty Ubuntu Pro 26.04 LTS 1:4.1.48-16ubuntu0.1~esm2

ubuntu advisories UBUNTU-CVE-2026-42581

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el9sso
  • rh-sso7-keycloak red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7.6 18.0.20-1.redhat_00001.1.el7sso
  • eap8-netty jboss enterprise application platform 8.1 4.1.135-1.Final_redhat_00001.1.el10eap
  • eap8-netty jboss enterprise application platform 8.1 4.1.135-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2026:76129RHSA-2026:76130RHSA-2026:76128RHSA-2026:73976RHSA-2026:73644RHSA-2026:53645

  • netty-tcnative SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.0.77-150200.3.39.1
  • netty SLE Module for Package Hub 15 SP7 4.1.133-150200.4.46.1

suse advisories SUSE-SU-2026:2308-1

  • netty openSUSE Tumbleweed 4.1.133-1.1

opensuse advisories openSUSE-SU-2026:10795-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-42581 updated cvss 7.2

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

  • Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, +4 more
    affected: workaround, no fix available
  • Red Hat build of Apicurio Registry 2 netty-codec-http
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 3 netty-codec-http
    affected: workaround, no fix available
  • Red Hat build of Debezium 3 netty-codec-http
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Build of Keycloak netty-codec-http, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat build of OptaPlanner 8 netty-codec-http
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Data Grid 8 netty-codec-http Red Hat Enterprise Linux AI (RHEL AI) 3 bazel6, bazel7, bazel8 Red Hat Fuse 7 netty-codec-http Red Hat JBoss Enterprise Application Platform Expansion Pack netty-codec-http
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel8, rhoai/odh-trustyai-service-rhel8, rhoai/odh-th06-cpu-torch210-py312-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-rocm64-torch291-py312-rhel9, rhoai/odh-th06-cuda130-torch210-py312-rhel9, +1 more
    affected: workaround, no fix available, no fix planned “Will not fix”
show 27 more
  • Red Hat Process Automation 7 netty-codec-http
    affected: workaround, no fix planned “Will not fix”
  • Red Hat AMQ Clients 2026.Q3
    fixed: vendor fix RHSA-2026:69459
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.2.0-10, cryostat/jfr-datasource-rhel9 4.2.0-10, cryostat/cryostat-reports-rhel9 4.2.0-10
    fixed: vendor fix RHSA-2026:28010
  • Red Hat Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8 7.6-85
    fixed: vendor fix RHSA-2026:76134
  • Red Hat AMQ Broker 7.13.6
    fixed: vendor fix RHSA-2026:66545
  • Red Hat AMQ Broker 7.14.1
    fixed: vendor fix RHSA-2026:66488
  • Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
    fixed: vendor fix RHSA-2026:37390
  • Red Hat build of Keycloak 26.4.13
    fixed: vendor fix RHSA-2026:30049
  • Red Hat build of Quarkus 3.27.4.redhat netty-codec-http 4.1.133.Final-redhat-00002
    fixed: vendor fix RHSA-2026:23808
  • Red Hat build of Quarkus 3.33.2.redhat netty-codec-http 4.1.133.Final-redhat-00002
    fixed: vendor fix RHSA-2026:24502
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.25-2.GA_redhat_00001.1.el7eap, eap7-jackson-core 2.18.8-1.redhat_00003.1.el7eap, eap7-netty 4.1.135-1.Final_redhat_00001.1.el7eap, eap7-undertow 2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-jackson-databind 2.18.8-1.redhat_00003.1.el7eap, eap7-netty-all 4.1.135-1.Final_redhat_00001.1.el7eap, +78 more
    fixed: vendor fix RHSA-2026:53644
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-jose4j 0.9.6-2.redhat_00002.1.el8eap, eap8-wildfly 8.1.7.1-1.GA_redhat_00004.1.el8eap, eap8-netty 4.1.135-1.Final_redhat_00001.1.el8eap, eap8-netty-codec 4.1.135-1.Final_redhat_00001.1.el8eap, eap8-netty-buffer 4.1.135-1.Final_redhat_00001.1.el8eap, eap8-netty-common 4.1.135-1.Final_redhat_00001.1.el8eap, +16 more Red Hat JBoss EAP 8.1 for RHEL 9 eap8-jose4j 0.9.6-2.redhat_00002.1.el9eap, eap8-wildfly 8.1.7.1-1.GA_redhat_00004.1.el9eap, eap8-netty 4.1.135-1.Final_redhat_00001.1.el9eap, eap8-netty-codec 4.1.135-1.Final_redhat_00001.1.el9eap, eap8-netty-buffer 4.1.135-1.Final_redhat_00001.1.el9eap, eap8-netty-common 4.1.135-1.Final_redhat_00001.1.el9eap, +16 more Red Hat JBoss EAP 8.1 for RHEL 10 eap8-wildfly 8.1.7.1-1.GA_redhat_00004.1.el10eap, eap8-netty 4.1.135-1.Final_redhat_00001.1.el10eap, eap8-netty-codec 4.1.135-1.Final_redhat_00001.1.el10eap, eap8-netty-buffer 4.1.135-1.Final_redhat_00001.1.el10eap, eap8-netty-common 4.1.135-1.Final_redhat_00001.1.el10eap, eap8-wildfly-modules 8.1.7.1-1.GA_redhat_00004.1.el10eap, +14 more
    fixed: vendor fix RHSA-2026:49700
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.16-1.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.63-4.Final_redhat_00005.1.ep7.el7, eap7-hibernate 5.1.17-5.Final_redhat_00006.1.ep7.el7, eap7-netty-all 4.1.63-4.Final_redhat_00005.1.ep7.el7, eap7-wildfly-modules 7.1.16-1.GA_redhat_00002.1.ep7.el7, eap7-hibernate-core 5.1.17-5.Final_redhat_00006.1.ep7.el7, +4 more
    fixed: vendor fix RHSA-2026:73976
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-wildfly 7.3.19-1.GA_redhat_00004.1.el7eap, eap7-netty 4.1.63-7.Final_redhat_00005.1.el7eap, eap7-hibernate 5.3.39-1.Final_redhat_00001.1.el7eap, eap7-netty-all 4.1.63-7.Final_redhat_00005.1.el7eap, eap7-wildfly-modules 7.3.19-1.GA_redhat_00004.1.el7eap, eap7-wildfly-javadocs 7.3.19-1.GA_redhat_00004.1.el7eap, +28 more
    fixed: vendor fix RHSA-2026:73644
  • Red Hat JBoss Enterprise Application Platform 7.4.25
    fixed: vendor fix RHSA-2026:53806
  • Red Hat JBoss Enterprise Application Platform 8.1.7.GA netty-codec-http 4.1.135.Final-redhat-00001
    fixed: vendor fix RHSA-2026:49701
  • Red Hat OpenShift AI 2.25 rhoai/odh-modelmesh-rhel9 1783443816, rhoai/odh-trustyai-service-rhel9 1788198681
    fixed: vendor fix RHSA-2026:42644
  • Red Hat OpenShift AI 3.4 rhoai/odh-trustyai-service-rhel9 1791792525
    fixed: vendor fix RHSA-2026:84734
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/server-rhel9 1780694994, devspaces/openvsx-rhel9 1780948325, devspaces/pluginregistry-rhel9 1780696380
    fixed: vendor fix RHSA-2026:25123
  • Red Hat OpenShift Dev Spaces 3.29 devspaces/multicluster-redirector-rhel9 1782989027
    fixed: vendor fix RHSA-2026:36820
  • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2026:76128
  • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2026:76129
  • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak 18.0.20-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server 18.0.20-1.redhat_00001.1.el9sso
    fixed: vendor fix RHSA-2026:76130
  • Red Hat Single Sign-On 7.6.13
    fixed: vendor fix RHSA-2026:76132
  • Red Hat Streams for Apache Kafka 3.2.1
    fixed: vendor fix RHSA-2026:54435
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-db-rhel9 4.2.0-16, cryostat/cryostat-storage-rhel9 4.2.0-16, cryostat/cryostat-operator-bundle 4.2.0-8, cryostat/cryostat-rhel9-operator 4.2.0-15, cryostat/cryostat-agent-init-rhel9 0.7.0-8, cryostat/cryostat-grafana-dashboard-rhel9 4.2.0-10, +1 more
    not affected: vulnerable code not present
  • Red Hat build of Apache Camel 4 for Quarkus 3 netty-codec-http
    not affected: inline mitigations already exist

11 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CISA ADP 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
GitHub 3.1 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
maven io.netty:netty-codec-http
>=4.2.0.Alpha1, <4.2.13.Final
<4.1.133.Final
4.2.13.Final
4.1.133.Final

Affected products

  • netty netty
  • Red Hat Cryostat 4 on RHEL 9
  • Red Hat Red Hat AMQ Broker 7.13.6
  • Red Hat Red Hat AMQ Broker 7.14.1
  • Red Hat Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16
  • Red Hat Red Hat build of Quarkus 3.27.4
  • Red Hat Red Hat build of Quarkus 3.33.2
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1.7.GA
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  • Red Hat Streams for Apache Kafka 3.2.1
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Red Hat OpenShift Dev Spaces 3.29
  • Red Hat OpenShift Serverless
  • Red Hat Red Hat AMQ Clients
  • Red Hat Red Hat build of Apache Camel 4 for Quarkus 3
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Build of Keycloak
  • Red Hat Red Hat build of OptaPlanner 8
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat OpenShift AI (RHOAI)
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.