CVE-2026-42584: Netty HttpClientCodec response desynchronization

CVE-2026-42584 · Severity: high · CVSS 7.3 · Published 2026-05-13

Netty is a widely used networking framework for Java applications. A vulnerability in its HTTP client component can cause the software to misinterpret server responses when multiple requests are sent over the same connection. This could allow an attacker to manipulate or intercept data, potentially leading to information disclosure or the disruption of service.

Technologies: io.netty:netty-codec-http (Maven), Netty Project Netty codec-http. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-42584 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42584 being exploited in the wild.
How severe is CVE-2026-42584?
High severity, with a CVSS score of 7.3, published 13 May 2026.
Which products and versions are affected?
io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=4.2.0.Alpha1,fixed=4.2.13.Final; Netty Project Netty codec-http >= 4.2.0.Alpha1, <= 4.2.12.Final; <= 4.1.132.Final.
Is there a fix for CVE-2026-42584?
Yes. io.netty:netty-codec-http (Maven): upgrade to 4.2.13.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42584 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42584?
Check whether you run io.netty:netty-codec-http (Maven) or Netty Project Netty codec-http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-http (Maven): upgrade to 4.2.13.Final or later
    # set io.netty:netty-codec-http to 4.2.13.Final in your pom.xml or build.gradle

Technical details

A vulnerability exists in Netty's HttpClientCodec where it incorrectly manages the request-response queue when handling HTTP 1xx (informational) responses. Specifically, the codec polls the request queue for every response, including 1xx hints. If a client pipelines a GET request followed by a HEAD request, and the server returns a 103 Early Hints followed by the GET response and then the HEAD response, the codec incorrectly pairs the HEAD request with the GET response body. Because HEAD requests are expected to have no body, the codec skips reading the GET entity bytes, leaving them on the stream. This causes subsequent responses to be parsed from the wrong offset, leading to response smuggling or desynchronization. The issue is fixed in versions 4.1.133.Final and 4.2.13.Final.

Affected products

  • Netty netty-codec-http < 4.1.133.Final, < 4.2.13.Final

Identifiers

  • CVE-2026-42584
  • GHSA-57rv-r2g8-2cj3

Timeline

  • 2026-05-05: advisory: GitHub Security Advisory published
  • 2026-05-13: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.