CVE-2026-42585: io.netty netty-codec-http HTTP Request/Response Smuggling

CVSS: 7.5v3.1HighAnalyzed

AliasesUBUNTU-CVE-2026-42585DEBIAN-CVE-2026-42585CGA-257x-468p-39mv+695 more

Published 13-05-2026Last modified 15-05-2026

Vulnerability summary

CVE-2026-42585 is a high (CVSS 7.5) HTTP Request/Response Smuggling vulnerability in io.netty netty-codec-http. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.5% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

40/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

0.29%

0%100%

Low · +0.03 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1github

Advisory lineage

Upstream 0 · Downstream 8 · Related 4

OPENSUSE-SU-2026:10795-1 RHSA-2026:49700 RHSA-2026:53644 RHSA-2026:53645 RHSA-2026:53646 RHSA-2026:73644+4 more

Timeline

13-05-2026
PublishedVulnerability first disclosed.
15-05-2026
Last modifiedVulnerability information updated.

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

0.29%

Chance of exploitation in the next 30 days

Percentile

21%

Versus all other CVEs

30-day change

+0.03 pp

From 0.27% on 20-09-2026

20-09-202620-10-2026

EPSS score

0.29%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

githubUnverified
Netty
Maturity: poc

Weaknesses

CWE · root cause

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Affected systems

Chainguard200 products

akhq< 0.27.1-r1
apache-activemq-artemis< 2.54.0-r2 | < 2.54.0-r1
apache-camel-karavan-devmode< 4.18.1-r1
apache-nifi< 2.9.0-r6
apache-nifi-registry< 2.9.0-r8

apache-pulsar-4.0< 4.0.10-r1
apache-pulsar-4.1< 4.1.3-r15
apache-pulsar-4.2< 4.2.1-r2
apache-pulsar-fips-4.0< 4.0.9-r16
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.1-r3
apicurio-registry< 3.2.1-r3
camunda-8.8< 8.8.24-r1
camunda-8.9< 8.9.5-r2
camunda-zeebe-8.6< 8.6.39-r6
camunda-zeebe-8.7< 8.7.29-r1
camunda-zeebe-8.8< 8.8.24-r1
camunda-zeebe-8.9< 8.9.5-r2
celeborn-0.5All versions (No fix recorded) | < 0.5.4-r26 | < 0.5.4-r23
celeborn-0.6< 0.6.3-r3 | < 0.6.3-r7 | All versions (No fix recorded)
celeborn-0.7< 0.7.0-r3
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.16-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3< 9.3.5-r0
commercial-elasticsearch-9.4< 9.4.1-r0
docker-selenium-base< 4.43.0.20260404-r2
druid< 37.0.0-r1
elasticsearch-7All versions (No fix recorded)
elasticsearch-7-iamguardedAll versions (No fix recorded)
elasticsearch-8.19< 8.19.15-r1
elasticsearch-8.19-iamguarded< 8.19.15-r1
elasticsearch-9.1< 9.1.10-r5
elasticsearch-9.1-iamguarded< 9.1.10-r5
elasticsearch-9.2< 9.2.8-r3
elasticsearch-9.2-iamguarded< 9.2.8-r3
elasticsearch-9.3< 9.3.4-r1
elasticsearch-9.3-iamguarded< 9.3.4-r1
elasticsearch-9.4< 9.4.1-r0
elasticsearch-9.4-iamguarded< 9.4.1-r0
elasticsearch-fips-8.19< 8.19.15-r1
elasticsearch-fips-9.1< 9.1.10-r12
elasticsearch-fips-9.2< 9.2.8-r1
elasticsearch-fips-9.3< 9.3.4-r1
elasticsearch-fips-9.4< 9.4.1-r0
flyway< 12.9.0-r0 | < 12.6.1-r0
flyway-fips< 12.5.0-r1
gremlin-server< 3.8.1-r2
grpc-java-fips-1.56.0-m2< 1.56.0-r6
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r12 | All versions (No fix recorded) | < 3.5.0-r3
hono-adapter-mqtt< 2.7.0-r14
hono-cli< 2.7.0-r14
hono-service-auth< 2.7.0-r14
hono-service-command-router< 2.7.0-r14 | < 2.7.0-r13
hono-service-device-registry-jdbc< 2.7.0-r14
infinispan-16.1< 16.1.3-r2
kafbat-ui< 1.4.2-r10
kafbat-ui-fips< 1.4.2-r9
kafka_exporter-strimzi-compat< 1.2.0-r5
kafka-bridge< 1.0.0-r4
kafka-strimzi-compat< 1.2.0-r5
kayenta-2025.0All versions (No fix recorded)
kayenta-2025.1All versions (No fix recorded)
kayenta-2025.2< 2025.2.4-r6
kayenta-2025.4< 2025.4.3-r8
kayenta-2026.0< 2026.0.2-r8
kayenta-2026.1< 2026.1.0-r1
kayenta-fips-2025.0All versions (No fix recorded)
kayenta-fips-2025.1All versions (No fix recorded)
kayenta-fips-2025.2< 2025.2.4-r7
kayenta-fips-2025.4< 2025.4.3-r9
kayenta-fips-2026.0< 2026.0.2-r9
kayenta-fips-2026.1< 2026.1.0-r1
keycloak-26.4All versions (No fix recorded)
keycloak-26.4-iamguarded-compatAll versions (No fix recorded)
keycloak-26.4-operatorAll versions (No fix recorded)
keycloak-26.5All versions (No fix recorded)
keycloak-26.5-iamguarded-compatAll versions (No fix recorded)
keycloak-26.5-operatorAll versions (No fix recorded)
keycloak-26.6< 26.6.1-r2
keycloak-26.6-iamguarded-compat< 26.6.1-r2
keycloak-26.6-operator< 26.6.1-r2
keycloak-fips-26.4All versions (No fix recorded)
keycloak-fips-26.4-iamguarded-fipsAll versions (No fix recorded)
keycloak-fips-26.4-operatorAll versions (No fix recorded)
keycloak-fips-26.5< 26.5.7-r10
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r10
keycloak-fips-26.5-operator< 26.5.7-r10
keycloak-fips-26.6< 26.6.1-r3
keycloak-fips-26.6-iamguarded-fips< 26.6.1-r3
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-1.21-dispatcher-loom< 1.21.4-r2
knative-kafka-broker-1.21-receiver-loom< 1.21.4-r2
knative-kafka-broker-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-1.22-receiver-loom< 1.22.1-r1
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r6
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r6
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.1-r1
kserve-modelmesh< 0.12.0-r33
localstack< 4.14.0-r10
logstash-8.19< 8.19.15-r1
logstash-8.19-iamguarded-compat< 8.19.15-r1
logstash-8.19-with-output-opensearch< 8.19.15-r1
logstash-9.0< 9.0.8-r23
logstash-9.0-iamguarded-compat< 9.0.8-r23
logstash-9.0-with-output-opensearch< 9.0.8-r23
logstash-9.1< 9.1.10-r8
logstash-9.1-bitnami-compat< 9.1.10-r8
logstash-9.1-iamguarded-compat< 9.1.10-r8
logstash-9.1-with-output-opensearch< 9.1.10-r8
logstash-9.2< 9.2.8-r4
logstash-9.2-iamguarded-compat< 9.2.8-r4
logstash-9.2-with-output-opensearch< 9.2.8-r4
logstash-9.3< 9.3.4-r4
logstash-9.3-iamguarded-compat< 9.3.4-r4
logstash-9.3-with-output-opensearchAll versions (No fix recorded)
logstash-fips-9.3All versions (No fix recorded)
logstash-fips-9.3-iamguarded-compatAll versions (No fix recorded)
management-api-for-apache-cassandra-4.0< 0.1.117-r1
management-api-for-apache-cassandra-4.1< 0.1.117-r1
management-api-for-apache-cassandra-5.0< 0.1.117-r1
neo4j-2025.08All versions (No fix recorded)
neo4j-2025.09All versions (No fix recorded)
neo4j-2025.10All versions (No fix recorded)
neo4j-2025.11All versions (No fix recorded)
neo4j-2025.12All versions (No fix recorded)
neo4j-2026.01< 2026.01.4-r1
neo4j-2026.02< 2026.02.3-r4
neo4j-2026.03< 2026.03.1-r4
neo4j-2026.04< 2026.04.0-r3
neo4j-4.4All versions (No fix recorded)
neo4j-5.26< 5.26.25-r2
nuxeo-2023< 2023.40-r4
opensearch-2< 2.19.4-r14
opensearch-2-ml-commons< 2.19.4-r14
opensearch-2-performance-analyzer< 2.19.4-r14 | < 2.19.4-r13
opensearch-2-repository-azure< 2.19.4-r13 | < 2.19.4-r14
opensearch-2-repository-s3< 2.19.4-r14 | < 2.19.4-r13
opensearch-2-security< 2.19.4-r14
opensearch-2-transport-nio< 2.19.4-r14
opensearch-3< 3.6.0-r5
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compatAll versions (No fix recorded)
opensearch-3-ml-commons< 3.6.0-r5
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-notifications< 3.6.0-r5
opensearch-3-performance-analyzer< 3.6.0-r5
opensearch-3-repository-azure< 3.6.0-r5
opensearch-3-repository-s3< 3.6.0-r5
opensearch-3-security< 3.6.0-r5
opensearch-3-security-analytics< 3.7.0-r0
opensearch-fips-3< 3.7.0-r0
opensearch-fips-3-ml-commons< 3.7.0-r0
opensearch-fips-3-notifications< 3.7.0-r0
opensearch-fips-3-performance-analyzer< 3.7.0-r0
opensearch-fips-3-repository-azure< 3.7.0-r0
opensearch-fips-3-repository-s3< 3.7.0-r0
opensearch-fips-3-security< 3.7.0-r0
opensearch-fips-3-security-analytics< 3.7.0-r0
pinot-fips< 1.5.0-r2
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
reposilite< 3.5.28-r3
seata-server< 2.6.0-r9
selenium-server< 4.44.0-r0
sonarqube< 26.7.0.124771-r0
spark-3.5-scala-2.12< 3.5.8-r13
spark-3.5-scala-2.13< 3.5.8-r13
spark-4.0-scala-2.13< 4.0.2-r12
spark-4.1-scala-2.13< 4.1.2-r1 | < 4.1.2-r0
spark-fips-3.5-scala-2.12< 3.5.8-r1
spark-fips-3.5-scala-2.13< 3.5.8-r1
spark-fips-4.1-scala-2.13< 4.1.1-r14
spark-kubernetes-operator< 0.9.0-r0
spark-kubernetes-operator-fips< 0.9.0-r0
strimzi-kafka-operator< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-cluster-operator< 0.51.0-r25 | < 1.2.0-r5
strimzi-kafka-operator-fips-cluster-operator< 1.0.0-r0
strimzi-kafka-operator-fips-kafka-agent< 1.0.0-r0
strimzi-kafka-operator-fips-kafka-init< 1.0.0-r0
strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc< 1.0.0-r0
strimzi-kafka-operator-fips-topic-operator< 1.0.0-r0
strimzi-kafka-operator-fips-tracing-agent< 1.0.0-r0
strimzi-kafka-operator-fips-user-operator< 1.0.0-r0
strimzi-kafka-operator-kafka-agent< 1.2.0-r5 | < 0.51.0-r25
strimzi-kafka-operator-kafka-base< 1.2.0-r5
strimzi-kafka-operator-kafka-init< 1.2.0-r5 | < 0.51.0-r25
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 0.51.0-r25 | < 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-topic-operator< 1.2.0-r5 | < 0.51.0-r25
strimzi-kafka-operator-tracing-agent< 0.51.0-r25 | < 1.2.0-r5
strimzi-kafka-operator-user-operator< 1.2.0-r5 | < 0.51.0-r25
tez< 0.10.5-r12
thingsboard-tb-mqtt-transport< 4.3.1.1-r5
thingsboard-tb-node< 4.3.1.1-r5

Show all 200

1 vendor · 200 products · Showing 200 of 302. Use Open JSON for the complete list.

References

9 links

github.com/netty/netty/security/advisories/GHSA-38f8-5428-x5cvX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
ubuntu.com/security/CVE-2026-42585REPORT
www.cve.org/CVERecord?id=CVE-2026-42585REPORT
ubuntu.com/security/notices/USN-8401-1Advisory
security-tracker.debian.org/tracker/CVE-2026-42585Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42585.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-42585Advisory
datatracker.ietf.org/doc/html/rfc9112WEB
github.com/netty/nettyPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities