CVE-2026-42583: io.netty netty-codec Uncontrolled Resource Consumption

CVSS: 7.5v3.1HighAnalyzed

AliasesUBUNTU-CVE-2026-42583DEBIAN-CVE-2026-42583CGA-22fq-9j7c-w7fr+867 more

Published 13-05-2026Last modified 14-05-2026

Vulnerability summary

CVE-2026-42583 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in io.netty netty-codec. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

40/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

0.49%

0%100%

Low · +0.02 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 4 · Related 3

OPENSUSE-SU-2026:10795-1 RHSA-2026:73644 RHSA-2026:73976 SUSE-SU-2026:2308-1 CGA-5C4G-HMFW-HQXP

Timeline

13-05-2026
PublishedVulnerability first disclosed.
14-05-2026
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.49%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

+0.02 pp

From 0.46% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

githubUnverified
Netty
Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Chainguard200 products

akhq< 0.27.1-r1
apache-activemq-artemis< 2.54.0-r1 | < 2.54.0-r2
apache-camel-karavan-devmode< 4.18.1-r1
apache-hop< 2.17.0-r14
apache-hop-fips< 2.17.0-r14

apache-nifi< 2.9.0-r6
apache-nifi-registry< 2.9.0-r8
apache-pulsar-4.0< 4.0.10-r1
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.1-r2
apache-pulsar-fips-4.0< 4.0.9-r16
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.1-r3
apicurio-registry< 3.2.1-r7
apicurio-registry-fips< 3.3.0-r2 | < 3.3.0-r3
camunda-8.8< 8.8.24-r1
camunda-8.9< 8.9.5-r2
camunda-zeebe-8.6< 8.6.39-r6
camunda-zeebe-8.7< 8.7.29-r1
camunda-zeebe-8.8< 8.8.24-r1
camunda-zeebe-8.9< 8.9.5-r2
cassandra-5.0< 5.0.8-r1
cassandra-fips-5.0< 5.0.6-r7
celeborn-0.5All versions (No fix recorded) | < 0.5.4-r23 | < 0.5.4-r26
celeborn-0.6< 0.6.3-r7 | All versions (No fix recorded) | < 0.6.3-r3
celeborn-0.7< 0.7.0-r3 | < 0.7.0-r7
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.16-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3< 9.3.5-r0
commercial-elasticsearch-9.4< 9.4.1-r0
docker-selenium-base< 4.43.0.20260404-r2
druid< 37.0.0-r5
elasticsearch-7All versions (No fix recorded)
elasticsearch-7-iamguardedAll versions (No fix recorded)
elasticsearch-8.19< 8.19.15-r1
elasticsearch-8.19-iamguarded< 8.19.15-r1
elasticsearch-9.1< 9.1.10-r5
elasticsearch-9.1-iamguarded< 9.1.10-r5
elasticsearch-9.2< 9.2.8-r3
elasticsearch-9.2-iamguarded< 9.2.8-r3
elasticsearch-9.3< 9.3.4-r1
elasticsearch-9.3-iamguarded< 9.3.4-r1
elasticsearch-9.4< 9.4.1-r0
elasticsearch-9.4-iamguarded< 9.4.1-r0
elasticsearch-fips-8.19< 8.19.15-r1
elasticsearch-fips-9.1< 9.1.10-r12
elasticsearch-fips-9.2< 9.2.8-r1
elasticsearch-fips-9.3< 9.3.4-r1
elasticsearch-fips-9.4< 9.4.1-r0
flyway< 12.9.0-r0 | < 12.6.0-r0
flyway-fips< 12.6.0-r0 | < 12.6.0-r2
gremlin-server< 3.8.1-r2
grpc-java-fips-1.56.0-m2< 1.56.0-r6
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r12 | < 3.5.0-r3 | All versions (No fix recorded)
hono-adapter-mqtt< 2.7.0-r17
hono-cli< 2.7.0-r15
hono-service-auth< 2.7.0-r14 | < 2.7.0-r15
hono-service-command-router< 2.7.0-r17 | < 2.7.0-r13
hono-service-device-registry-jdbc< 2.7.0-r16
infinispan-15.0< 15.0.22-r7
infinispan-15.1< 15.1.7-r17
infinispan-15.2< 15.2.6-r17
infinispan-16.0< 16.0.11-r3 | < 16.0.11-r4
infinispan-16.1< 16.1.3-r2
kafbat-ui< 1.4.2-r10
kafbat-ui-fips< 1.4.2-r9
kafka_exporter-strimzi-compat< 1.2.0-r5
kafka-3.7< 3.7.2-r54
kafka-3.8< 3.8.1-r54
kafka-3.9< 3.9.2-r5
kafka-bridge< 1.0.0-r4
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.0All versions (No fix recorded)
kayenta-2025.1All versions (No fix recorded)
kayenta-2025.2< 2025.2.4-r6
kayenta-2025.4< 2025.4.3-r8
kayenta-2026.0< 2026.0.2-r8
kayenta-2026.1< 2026.1.0-r1
kayenta-fips-2025.0All versions (No fix recorded)
kayenta-fips-2025.1All versions (No fix recorded)
kayenta-fips-2025.2< 2025.2.4-r7
kayenta-fips-2025.4< 2025.4.3-r9
kayenta-fips-2026.0< 2026.0.2-r9
kayenta-fips-2026.1< 2026.1.0-r1
keycloak-26.4All versions (No fix recorded)
keycloak-26.4-iamguarded-compatAll versions (No fix recorded)
keycloak-26.4-operatorAll versions (No fix recorded)
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.1-r2
keycloak-26.6-iamguarded-compat< 26.6.1-r2
keycloak-26.6-operator< 26.6.1-r2
keycloak-fips-26.4All versions (No fix recorded)
keycloak-fips-26.4-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.4-operatorAll versions (No fix recorded)
keycloak-fips-26.5< 26.5.7-r5
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r5
keycloak-fips-26.5-operator< 26.5.7-r5
keycloak-fips-26.6< 26.6.1-r6
keycloak-fips-26.6-iamguarded-fips< 26.6.1-r6
keycloak-fips-26.6-operator< 26.6.1-r6
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-1.21-dispatcher-loom< 1.21.3-r3 | < 1.21.3-r4
knative-kafka-broker-1.21-receiver-loom< 1.21.3-r4 | < 1.21.3-r3
knative-kafka-broker-1.22-dispatcher-loom< 1.22.0-r2
knative-kafka-broker-1.22-receiver-loom< 1.22.0-r4
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.3-r6
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.3-r6
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.0-r3 | < 1.22.0-r2
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.0-r4 | < 1.22.0-r3
kserve-modelmesh< 0.12.0-r33
localstack< 4.14.0-r11
logstash-8.19< 8.19.15-r1
logstash-8.19-iamguarded-compat< 8.19.15-r1
logstash-8.19-with-output-opensearch< 8.19.15-r1
logstash-9.0< 9.0.8-r23
logstash-9.0-iamguarded-compat< 9.0.8-r23
logstash-9.0-with-output-opensearch< 9.0.8-r23
logstash-9.1< 9.1.10-r8
logstash-9.1-bitnami-compat< 9.1.10-r8
logstash-9.1-iamguarded-compat< 9.1.10-r8
logstash-9.1-with-output-opensearch< 9.1.10-r8
logstash-9.2< 9.2.8-r4
logstash-9.2-iamguarded-compat< 9.2.8-r4
logstash-9.2-with-output-opensearch< 9.2.8-r4
logstash-9.3< 9.3.4-r4
logstash-9.3-iamguarded-compat< 9.3.4-r4
logstash-9.3-with-output-opensearchAll versions (No fix recorded)
logstash-fips-9.3All versions (No fix recorded)
logstash-fips-9.3-iamguarded-compatAll versions (No fix recorded)
management-api-for-apache-cassandra-4.0< 0.1.117-r1
management-api-for-apache-cassandra-4.1< 0.1.117-r1
management-api-for-apache-cassandra-5.0< 0.1.117-r1
neo4j-2025.08All versions (No fix recorded)
neo4j-2025.09All versions (No fix recorded)
neo4j-2025.10All versions (No fix recorded)
neo4j-2025.11All versions (No fix recorded)
neo4j-2025.12All versions (No fix recorded)
neo4j-2026.01< 2026.01.4-r1
neo4j-2026.02< 2026.02.3-r4
neo4j-2026.03< 2026.03.1-r4
neo4j-2026.04< 2026.04.0-r3
neo4j-4.4All versions (No fix recorded)
neo4j-5.26< 5.26.25-r2
nuxeo-2023< 2023.40-r4
opensearch-2< 2.19.4-r14
opensearch-2-ml-commons< 2.19.4-r14
opensearch-2-performance-analyzer< 2.19.4-r14 | < 2.19.4-r13
opensearch-2-repository-azure< 2.19.4-r14 | < 2.19.4-r13
opensearch-2-repository-s3< 2.19.4-r14 | < 2.19.4-r13
opensearch-2-security< 2.19.4-r14
opensearch-2-transport-nio< 2.19.4-r14
opensearch-3< 3.6.0-r5
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-ml-commons< 3.6.0-r5
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-notifications< 3.6.0-r5
opensearch-3-repository-azure< 3.6.0-r5
opensearch-3-repository-s3< 3.6.0-r5
opensearch-3-security< 3.6.0-r5
opensearch-3-security-analytics< 3.7.0-r0
opensearch-fips-3< 3.7.0-r0
opensearch-fips-3-ml-commons< 3.7.0-r0
opensearch-fips-3-notifications< 3.7.0-r0
opensearch-fips-3-repository-azure< 3.7.0-r0
opensearch-fips-3-repository-s3< 3.7.0-r0
opensearch-fips-3-security< 3.7.0-r0
opensearch-fips-3-security-analytics< 3.7.0-r0
pinot< 1.5.0-r6
pinot-fips< 1.5.0-r5
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
reposilite< 3.5.28-r3
s3proxy< 3.1.0-r2 | < 3.1.0-r3
s3proxy-fips< 3.1.0-r3
seata-server< 2.6.0-r9
selenium-server< 4.44.0-r0
sonarqube< 26.7.0.124771-r0
spark-3.5-scala-2.12< 3.5.8-r13
spark-3.5-scala-2.13< 3.5.8-r13
spark-4.0-scala-2.13< 4.0.2-r12
spark-4.1-scala-2.13< 4.1.2-r1 | < 4.1.2-r0
spark-fips-3.5-scala-2.12< 3.5.8-r1
spark-fips-3.5-scala-2.13< 3.5.8-r1
spark-fips-4.1-scala-2.13< 4.1.1-r14
spark-kubernetes-operator< 0.9.0-r0
spark-kubernetes-operator-fips< 0.9.0-r0
strimzi-kafka-operator< 1.2.0-r5
strimzi-kafka-operator-cluster-operator< 0.51.0-r26 | < 1.2.0-r5
strimzi-kafka-operator-fips-cluster-operator< 1.0.0-r0
strimzi-kafka-operator-fips-kafka-agent< 1.0.0-r0

Show all 200

1 vendor · 200 products · Showing 200 of 330. Use Open JSON for the complete list.

References

7 links

github.com/netty/netty/security/advisories/GHSA-mj4r-2hfc-f8p6X Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
ubuntu.com/security/CVE-2026-42583REPORT
www.cve.org/CVERecord?id=CVE-2026-42583REPORT
security-tracker.debian.org/tracker/CVE-2026-42583Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42583.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-42583Advisory
github.com/netty/nettyPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities