Log in / Sign up

Vulnerability details

CVE-2026-42582

io.netty netty-codec-http3netty netty

Netty: HTTP/3 QPACK literal unbounded allocation

CVSS 3.1
7.5High

Official description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.

CVSS scores

ScoreVersionSourceVector
7.5High 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

VendorProductVersionsSource
io.netty netty-codec-http3 >= 4.2.0.Alpha1, < 4.2.13.Final CVEProject cvelistV5 (CNA)
netty netty >= 4.2.0.Alpha1, < 4.2.13.Final CVEProject cvelistV5 (CNA)

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-05-13
Last updated
2026-05-13
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

0.43%
Probability of exploitation in 30 days
38.1%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Proof of concept
Technical impact
Partial

Weaknesses (CWE)

  • CWE-770
    Allocation of Resources Without Limits or Throttling
  • CWE-789
    Memory Allocation with Excessive Size Value