Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.
References
| Link | Resource |
|---|---|
| https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw | Exploit Vendor Advisory |
| https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw | Exploit Vendor Advisory |
Configurations
History
18 May 2026, 12:54
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Netty netty
Netty |
|
| CPE | cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:* | |
| References | () https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw - Exploit, Vendor Advisory |
13 May 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw - |
13 May 2026, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-13 19:17
Updated : 2026-05-18 12:54
NVD link : CVE-2026-42582
Mitre link : CVE-2026-42582
CVE.ORG link : CVE-2026-42582
JSON object : View
Products Affected
netty
- netty