CVE-2026-42577: netty

CVSS: 7.5v3.1HighAnalyzed

AliasesUBUNTU-CVE-2026-42577DEBIAN-CVE-2026-42577CGA-239g-jr8c-xgr2+575 more

Published 13-05-2026Last modified 14-05-2026

Vulnerability summary

CVE-2026-42577 is a high (CVSS 7.5) vulnerability in netty. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.58%

0%100%

Low · +0.17 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-PCRM-JRQ4-V7HW

Timeline

13-05-2026
PublishedVulnerability first disclosed.
14-05-2026
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.58%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

+0.17 pp

From 0.41% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-772Missing Release of Resource after Effective LifetimeThe product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.

Affected systems

Chainguard142 products

akhq< 0.27.1-r13
apache-activemq-artemis< 2.54.0-r0
apache-hop< 2.17.0-r15
apache-hop-fips< 2.17.0-r15
apache-nifi< 2.9.0-r10

apache-pulsar-4.0< 4.0.10-r0
apache-pulsar-4.1< 4.1.3-r11
apache-pulsar-4.2< 4.2.1-r2
apache-pulsar-fips-4.0< 4.0.9-r16
apache-pulsar-fips-4.1< 4.1.3-r10
apache-pulsar-fips-4.2< 4.2.1-r2
camunda-8.8< 8.8.24-r1
camunda-8.9< 8.9.5-r2
camunda-zeebe-8.6< 8.6.39-r1
camunda-zeebe-8.7< 8.7.29-r0
camunda-zeebe-8.8< 8.8.24-r0
camunda-zeebe-8.9< 8.9.5-r2
cassandra-5.0< 5.0.8-r0
cassandra-fips-5.0< 5.0.6-r6
cassandra-reaper< 4.2.1-r2
celeborn-0.5< 0.5.4-r22
celeborn-0.6< 0.6.3-r1
celeborn-0.7< 0.7.0-r7
druid< 37.0.0-r9 | < 37.0.0-r8
flyway< 12.6.0-r0
flyway-fips< 12.6.0-r0
grpc-java-fips-1.56.0-m2< 1.56.0-r5
hadoop-fips-3.3.6< 3.3.6-r21
hadoop-fips-3.4.2< 3.4.2-r0
hono-adapter-mqtt< 2.7.0-r17
hono-service-auth< 2.7.0-r17
hono-service-command-router< 2.7.0-r17
hono-service-device-registry-jdbc< 2.7.0-r17
infinispan-15.0< 15.0.22-r7
infinispan-15.1< 15.1.7-r17
infinispan-15.2< 15.2.6-r17
infinispan-16.0< 16.0.11-r4
infinispan-16.1< 16.1.3-r2
kafbat-ui< 1.4.2-r9
kafbat-ui-fips< 1.4.2-r8
kafka_exporter-strimzi-compat< 1.2.0-r5
kafka-3.7< 3.7.2-r53
kafka-3.8< 3.8.1-r53
kafka-3.9< 3.9.2-r4
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.0All versions (No fix recorded)
kayenta-2025.1< 2025.1.6-r9
kayenta-2025.2< 2025.2.4-r5
kayenta-2025.4< 2025.4.3-r7
kayenta-2026.0< 2026.0.2-r7
kayenta-2026.1< 2026.1.0-r0
kayenta-fips-2025.0All versions (No fix recorded)
kayenta-fips-2025.1< 2025.1.6-r10
kayenta-fips-2025.2< 2025.2.4-r6
kayenta-fips-2025.4< 2025.4.3-r8
kayenta-fips-2026.0< 2026.0.2-r8
kayenta-fips-2026.1< 2026.1.0-r0
keycloak-26.4< 26.4.7-r9
keycloak-26.4-iamguarded-compat< 26.4.7-r9
keycloak-26.5< 26.5.7-r1
keycloak-26.5-iamguarded-compat< 26.5.7-r1
keycloak-26.6< 26.6.1-r2
keycloak-26.6-iamguarded-compat< 26.6.1-r2
keycloak-fips-26.4< 26.4.7-r14
keycloak-fips-26.4-iamguarded-fips< 26.4.7-r14
keycloak-fips-26.5< 26.5.7-r0
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r0
keycloak-fips-26.6< 26.6.1-r6
keycloak-fips-26.6-iamguarded-fips< 26.6.1-r6
kserve-modelmesh< 0.12.0-r31
localstack< 4.14.0-r11 | < 4.14.0-r9
management-api-for-apache-cassandra-4.0< 0.1.117-r0
management-api-for-apache-cassandra-4.1< 0.1.117-r0
management-api-for-apache-cassandra-5.0< 0.1.116-r0
neo4j-2025.08All versions (No fix recorded)
neo4j-2025.09All versions (No fix recorded)
neo4j-2025.10All versions (No fix recorded)
neo4j-2025.11All versions (No fix recorded)
neo4j-2025.12All versions (No fix recorded) | < 2025.12.1-r3
neo4j-2026.01< 2026.01.4-r1
neo4j-2026.02< 2026.02.3-r4 | < 2026.02.3-r0
neo4j-2026.03< 2026.03.1-r4 | < 2026.03.1-r1
neo4j-2026.04< 2026.04.0-r3 | < 2026.04.0-r0
neo4j-4.4< 4.4.48-r0
neo4j-5.26< 5.26.25-r1
pinot< 1.5.0-r6
pinot-fips< 1.5.0-r5
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
s3proxy< 3.1.0-r4
s3proxy-fips< 3.1.0-r3
seata-server< 2.6.0-r8
solr-10< 10.0.0-r2
solr-9< 9.10.1-r5
spark-3.5-scala-2.12< 3.5.8-r12
spark-3.5-scala-2.13< 3.5.8-r12
spark-4.0-scala-2.13< 4.0.2-r11
spark-4.1-scala-2.13< 4.1.2-r1
spark-fips-3.5-scala-2.12< 3.5.8-r0
spark-fips-3.5-scala-2.13< 3.5.8-r0
spark-fips-4.1-scala-2.13< 4.1.1-r14
spark-kubernetes-operator< 0.9.0-r0
spark-kubernetes-operator-fips< 0.9.0-r0
strimzi-kafka-operatorAll versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-cluster-operator< 1.2.0-r5 | < 0.51.0-r26
strimzi-kafka-operator-fips-cluster-operator< 1.0.0-r0
strimzi-kafka-operator-fips-kafka-agent< 1.0.0-r0
strimzi-kafka-operator-fips-kafka-init< 1.0.0-r0
strimzi-kafka-operator-fips-topic-operator< 1.0.0-r0
strimzi-kafka-operator-fips-tracing-agent< 1.0.0-r0
strimzi-kafka-operator-fips-user-operator< 1.0.0-r0
strimzi-kafka-operator-kafka-agent< 1.2.0-r5 | < 0.51.0-r26
strimzi-kafka-operator-kafka-base< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-kafka-init< 1.2.0-r5 | < 0.51.0-r26
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.2.0-r5 | < 0.51.0-r24 | All versions (No fix recorded)
strimzi-kafka-operator-topic-operator< 0.51.0-r26 | All versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-tracing-agent< 0.51.0-r26 | < 1.2.0-r5
strimzi-kafka-operator-user-operator< 1.2.0-r5 | < 0.51.0-r26
tez< 0.10.5-r11
thingsboard-tb-mqtt-transport< 4.3.1.1-r10
thingsboard-tb-node< 4.3.1.1-r10
trino-plugin-delta-lake< 481-r0
trino-plugin-exchange-filesystem< 481-r0
trino-plugin-exchange-hdfs< 481-r0
trino-plugin-hive< 481-r0
trino-plugin-hudi< 481-r0
trino-plugin-iceberg< 481-r0
trino-plugin-kafka< 481-r0
trino-plugin-kafka-event-listener< 481-r0
trino-plugin-lakehouse< 481-r0
trino-plugin-pinot< 481-r0
trino-plugin-ranger< 481-r0
trino-plugin-spooling-filesystem< 481-r0
wavefront-proxy< 13.9-r12
wildfly-openjdk-17< 39.0.1-r9
wildfly-openjdk-21< 39.0.1-r9
zipkin< 3.6.1-r6
zipkin-slim< 3.6.1-r6
zookeeper-3.8< 3.8.6-r1
zookeeper-3.9< 3.9.5-r1
zookeeper-fips-3.8< 3.8.6-r2
zookeeper-fips-3.9< 3.9.5-r0

Show all 142

Wolfi58 products

akhq< 0.27.1-r13
apache-activemq-artemis< 2.54.0-r0
apache-nifi< 2.9.0-r10
apache-pulsar-4.1< 4.1.3-r11
apache-pulsar-4.2< 4.2.1-r2

cassandra-5.0< 5.0.8-r0
cassandra-reaper< 4.2.1-r2
celeborn-0.6< 0.6.3-r1
druid< 37.0.0-r9 | < 37.0.0-r8
flyway< 12.6.0-r0
infinispan-16.0< 16.0.11-r4
infinispan-16.1< 16.1.3-r2
kafka_exporter-strimzi-compat< 1.2.0-r5
kafka-strimzi-compat< 1.2.0-r5
keycloak-26.4< 26.4.7-r9
keycloak-26.4-iamguarded-compat< 26.4.7-r9
keycloak-26.5< 26.5.7-r1
keycloak-26.5-iamguarded-compat< 26.5.7-r1
keycloak-26.6< 26.6.1-r2
keycloak-26.6-iamguarded-compat< 26.6.1-r2
kserve-modelmesh< 0.12.0-r31
management-api-for-apache-cassandra-5.0< 0.1.116-r0
neo4j-2025.10All versions (No fix recorded)
neo4j-2025.12All versions (No fix recorded) | < 2025.12.1-r3
neo4j-2026.01< 2026.01.4-r1
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
solr-10< 10.0.0-r2
spark-4.0-scala-2.13< 4.0.2-r11
spark-4.1-scala-2.13< 4.1.2-r1
strimzi-kafka-operatorAll versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-cluster-operator< 1.2.0-r5 | < 0.51.0-r26
strimzi-kafka-operator-kafka-agent< 1.2.0-r5 | < 0.51.0-r26
strimzi-kafka-operator-kafka-base< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-kafka-init< 1.2.0-r5 | < 0.51.0-r26
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.2.0-r5 | < 0.51.0-r24 | All versions (No fix recorded)
strimzi-kafka-operator-topic-operator< 0.51.0-r26 | All versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-tracing-agent< 0.51.0-r26 | < 1.2.0-r5
strimzi-kafka-operator-user-operator< 1.2.0-r5 | < 0.51.0-r26
tez< 0.10.5-r11
thingsboard-tb-mqtt-transport< 4.3.1.1-r10
thingsboard-tb-node< 4.3.1.1-r10
trino-plugin-delta-lake< 481-r0
trino-plugin-exchange-filesystem< 481-r0
trino-plugin-exchange-hdfs< 481-r0
trino-plugin-hive< 481-r0
trino-plugin-hudi< 481-r0
trino-plugin-iceberg< 481-r0
trino-plugin-kafka< 481-r0
trino-plugin-kafka-event-listener< 481-r0
trino-plugin-lakehouse< 481-r0
trino-plugin-pinot< 481-r0
trino-plugin-ranger< 481-r0
trino-plugin-spooling-filesystem< 481-r0
wavefront-proxy< 13.9-r12
wildfly-openjdk-17< 39.0.1-r9
wildfly-openjdk-21< 39.0.1-r9
zipkin< 3.6.1-r6

Show all 58

2 vendors · 200 products · Showing 200 of 206. Use Open JSON for the complete list.

References

9 links

github.com/netty/netty/security/advisories/GHSA-rwm7-x88c-3g2pX Refsource CONFIRMREPORTAdvisoryWEBMitigationVendor Advisory
github.com/netty/netty/pull/16689X Refsource MISCREPORTFIXWEBIssue TrackingPatch
github.com/netty/netty/commit/0ec3d97fab376e243d328ac95fbd288ba0f6e22dX Refsource MISCREPORTFIXWEBPatch
ubuntu.com/security/CVE-2026-42577REPORT
www.cve.org/CVERecord?id=CVE-2026-42577REPORT
security-tracker.debian.org/tracker/CVE-2026-42577Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42577.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-42577Advisory
github.com/netty/nettyPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities