Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723 Exploit, Vendor Advisory
- https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · nettyNVD modified 2026-10-26 17:10
Affected (CPE criteria) 1
cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*
References 2
- https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723 Exploit, Vendor Advisory
- https://github.com/netty/netty/security/advisories/GHSA-m4cv-j2px-7723 Exploit, Vendor Advisory