CVE-2026-42582

{
  "id": "CVE-2026-42582",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-13T19:17:23.763",
  "lastModified": "2026-10-26T00:10:00.150",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final."
    },
    {
      "lang": "es",
      "value": "Netty es un framework de aplicación de red asíncrono y basado en eventos. Antes de la versión 4.2.13.Final, al decodificar bloques de cabecera, la rama no-Huffman de io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral puede ejecutar new byte[length] para un literal de cadena antes de verificar que ’length’ bytes estén realmente presentes en la sección de campo comprimido. La codificación en la red permite que una longitud muy grande se exprese en pocos bytes. No hay una comprobación de que length <= in.readableBytes() antes de new byte[length]. Esta vulnerabilidad se corrige en la versión 4.2.13.Final."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "netty",
          "product": "netty",
          "versions": [
            {
              "version": ">= 4.2.0.Alpha1, < 4.2.13.Final",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "io.netty",
          "product": "netty-codec-http3",
          "versions": [
            {
              "version": ">= 4.2.0.Alpha1, < 4.2.13.Final",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T19:35:22.097676Z",
          "id": "CVE-2026-42582",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        },
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.2.0",
              "versionEndExcluding": "4.2.13",
              "matchCriteriaId": "D94A720F-9CED-4BE9-8C37-FD9E2FD28472"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/netty/netty/security/advisories/GHSA-2c5c-chwr-9hqw",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}