VulnSocial

CVE-2026-42583Disclosure(netty / netty)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch netty netty systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

netty CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-400CWE-770

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • netty

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-05-07); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
netty
Products
netty

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-05-07: 1Mentions · 2026-05-13: 1Patch / Workaround · 2026-05-13: 1Technical Details · 2026-05-07: 1Technical Details · 2026-05-13: 105-0705-13
Signal classification1 categories
Disclosure
2100.0%
Referenced assets4 URLs
Full discourse2 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-42583 Memory Exhaustion in Netty Lz4FrameDecoder Before http://4.2.13.Final and http://4.1.133.Final https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42583

    Post summary

    A memory exhaustion vulnerability (CVE-2026-42583) in Netty's Lz4FrameDecoder affecting versions prior to 4.2.13.Final and 4.1.133.Final is disclosed, with no PoC, exploit, or active exploitation reported, but patches are available in the newer releases.

    0000058
    4.0K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 Netty, Resource Exhaustion, #CVE-2026-42583 (High) https://dailycve.com/netty-resource-exhaustion-cve-2026-42583-high/

    Post summary

    A brief announcement of Netty’s resource exhaustion vulnerability CVE‑2026‑42583 with high severity.

    0000028
    196 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnettynetty---

Explore more

Back to dashboardnetty CVEsnetty vulnerabilities