CVE-2026-42583 PUBLISHED

Netty: Lz4FrameDecoder resource exhaustion

Assigner: GitHub_M
Reserved: 28.04.2026 Published: 13.05.2026 Updated: 13.05.2026

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Product Status

Vendor netty
Product netty
Versions
  • Version >= 4.2.0.Alpha1, < 4.2.13.Final is affected
  • Version < 4.1.133.Final is affected
Vendor io.netty
Product netty-codec
Versions
  • Version < 4.1.133.Final is affected
Vendor io.netty
Product netty-codec-compression
Versions
  • Version < 4.2.13.Final is affected

References

Problem Types

  • CWE-400: Uncontrolled Resource Consumption CWE
  • CWE-770: Allocation of Resources Without Limits or Throttling CWE