cveboard RSS feed

CVE-2026-42583

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

Netty: Lz4FrameDecoder resource exhaustion

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

netty

Vendor
netty
Product
netty
Platforms
Unknown
Default status
Unknown
netty · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
>= 4.2.0.Alpha1, < 4.2.13.FinalaffectedUnavailableUnavailableUnavailableNone listed
< 4.1.133.FinalaffectedUnavailableUnavailableUnavailableNone listed

netty-codec

Vendor
io.netty
Product
netty-codec
Platforms
Unknown
Default status
Unknown
netty-codec · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
< 4.1.133.FinalaffectedUnavailableUnavailableUnavailableNone listed

netty-codec-compression

Vendor
io.netty
Product
netty-codec-compression
Platforms
Unknown
Default status
Unknown
netty-codec-compression · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
< 4.2.13.FinalaffectedUnavailableUnavailableUnavailableNone listed