Vulnerability details
CVE-2026-42587
Red Hat Cryostat 4Red Hat OpenShift ServerlessRed Hat AMQ ClientsRed Hat Build of KeycloakRed Hat Fuse 7Red Hat JBoss Enterprise Application Platform Expansion Pack
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
CVSS 3.1
7.5High
Official description
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| 7.5High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Cryostat 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Serverless | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AMQ Clients | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Process Automation 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Process Automation 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Single Sign-On 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Single Sign-On 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Debezium 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Debezium 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of OptaPlanner 8 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of OptaPlanner 8 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | streams for Apache Kafka 2 | All | CVEProject cvelistV5 (CNA) |
| io.netty | netty-codec-http | < 4.1.133.Final | CVEProject cvelistV5 (CNA) |
| io.netty | netty-codec-http | >= 4.2.0.Alpha1, < 4.2.13.Final | CVEProject cvelistV5 (CNA) |
| io.netty | netty-codec-http2 | < 4.1.133.Final | CVEProject cvelistV5 (CNA) |
| io.netty | netty-codec-http2 | >= 4.2.0.Alpha1, < 4.2.13.Final | CVEProject cvelistV5 (CNA) |
| netty | netty | < 4.1.133.Final | CVEProject cvelistV5 (CNA) |
| netty | netty | >= 4.2.0.Alpha1, < 4.2.13.Final | CVEProject cvelistV5 (CNA) |
References and advisories
23- https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-42587 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2477220 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:49700 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53644 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53645 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28010 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:53646 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:66488 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41951 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:50085 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:49701 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:65126 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25123 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37390 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23808 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24502 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34608 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54435 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-13
- Last updated
- 2026-09-18
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.99%
Probability of exploitation in 30 days
62.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-400Uncontrolled Resource Consumption
- CWE-770Allocation of Resources Without Limits or Throttling