Bug 2477227 (CVE-2026-42585) - CVE-2026-42585 netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing
Summary: CVE-2026-42585 netty: io.netty/netty-codec-http: Netty: Request smuggling via...
Keywords:
Status: NEW
Alias: CVE-2026-42585
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2482692
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-13 19:02 UTC by OSIDB Bzimport
Modified: 2026-05-28 14:23 UTC (History)
104 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-05-13 19:02:28 UTC 
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Note You need to log in before you can comment on or make changes to this bug.