CVE-2026-42584

netty

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-42584

Katalog CVE

CVSS 9.1 · Critical EPSS 0,72%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada netty. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message’s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Rincian

Terbit di NVD
13 Mei 2026
Terakhir diubah
18 September 2026
Status NVD
Modified
CVSS 3.1
9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
EPSS (30 hari)
0,72% peluang dieksploitasi; lebih tinggi dari 52,5% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
netty netty Semua versi sebelum 4.1.133
netty netty Versi 4.2.0 hingga sebelum 4.2.13

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.