Patchwire CVEs, their patch status, and feeds to follow them

CVE-2026-42580

Fixed in a distro release EPSS <1%CVSS 6.5

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Published 2026-05-13 · CVE record · OSV

Products: netty, io.netty netty-codec-http

Fixed upstream

EcosystemPackageFixed in
Mavenio.netty:netty-codec-http4.2.13.Final
Mavenio.netty:netty-codec-http4.1.133.Final

Distro releases

ReleasePackageFixed in
Chainguardakhq0.27.1-r1
Chainguardapache-activemq-artemis2.54.0-r1
Chainguardapache-activemq-artemis2.54.0-r2
Chainguardapache-camel-karavan-devmode4.18.1-r1
Chainguardapache-nifi2.9.0-r6
Chainguardapache-nifi-registry2.9.0-r8
Chainguardapache-pulsar-4.04.0.10-r1
Chainguardapache-pulsar-4.14.1.3-r15
Chainguardapache-pulsar-4.24.2.1-r2
Chainguardapache-pulsar-fips-4.04.0.9-r16
Chainguardapache-pulsar-fips-4.1no fix
Chainguardapache-pulsar-fips-4.24.2.1-r3
Chainguardapicurio-registry3.2.1-r3
Chainguardcamunda-8.88.8.24-r1
Chainguardcamunda-8.98.9.5-r2
Chainguardcamunda-zeebe-8.68.6.39-r6
Chainguardcamunda-zeebe-8.78.7.29-r1
Chainguardcamunda-zeebe-8.88.8.24-r1
Chainguardcamunda-zeebe-8.98.9.5-r2
Chainguardceleborn-0.5no fix
Chainguardceleborn-0.50.5.4-r26
Chainguardceleborn-0.50.5.4-r23
Chainguardceleborn-0.60.6.3-r3
Chainguardceleborn-0.6no fix
Chainguardceleborn-0.60.6.3-r7
Chainguardceleborn-0.70.7.0-r3
Chainguardcommercial-elasticsearch-8.17no fix
Chainguardcommercial-elasticsearch-8.198.19.16-r0
Chainguardcommercial-elasticsearch-9.1no fix
Chainguardcommercial-elasticsearch-9.2no fix
Chainguardcommercial-elasticsearch-9.39.3.5-r0
Chainguardcommercial-elasticsearch-9.49.4.1-r0
Chainguarddocker-selenium-base4.43.0.20260404-r2
Chainguarddruid37.0.0-r1
Chainguardelasticsearch-7no fix
Chainguardelasticsearch-7-iamguardedno fix
Chainguardelasticsearch-8.198.19.15-r1
Chainguardelasticsearch-8.19-iamguarded8.19.15-r1
Chainguardelasticsearch-9.19.1.10-r5
Chainguardelasticsearch-9.1-iamguarded9.1.10-r5
Chainguardelasticsearch-9.29.2.8-r3
Chainguardelasticsearch-9.2-iamguarded9.2.8-r3
Chainguardelasticsearch-9.39.3.4-r1
Chainguardelasticsearch-9.3-iamguarded9.3.4-r1
Chainguardelasticsearch-9.49.4.1-r0
Chainguardelasticsearch-9.4-iamguarded9.4.1-r0
Chainguardelasticsearch-fips-8.198.19.15-r1
Chainguardelasticsearch-fips-9.19.1.10-r12
Chainguardelasticsearch-fips-9.29.2.8-r1
Chainguardelasticsearch-fips-9.39.3.4-r1
Chainguardelasticsearch-fips-9.49.4.1-r0
Chainguardflyway12.9.0-r0
Chainguardflyway12.6.1-r0
Chainguardflyway-fips12.5.0-r1
Chainguardgremlin-server3.8.1-r2
Chainguardgrpc-java-fips-1.56.0-m21.56.0-r6
Chainguardhadoop-3.5no fix
Chainguardhadoop-fips-3.3.6no fix
Chainguardhadoop-fips-3.4.2no fix
Chainguardhadoop-fips-3.53.5.0-r12
Chainguardhadoop-fips-3.53.5.0-r3
Chainguardhadoop-fips-3.5no fix
Chainguardhono-adapter-mqtt2.7.0-r14
Chainguardhono-cli2.7.0-r14
Chainguardhono-service-auth2.7.0-r14
Chainguardhono-service-command-router2.7.0-r14
Chainguardhono-service-command-router2.7.0-r13
Chainguardhono-service-device-registry-jdbc2.7.0-r14
Chainguardinfinispan-16.116.1.3-r2
Chainguardkafbat-ui1.4.2-r10
Chainguardkafbat-ui-fips1.4.2-r9
Chainguardkafka-bridge1.0.0-r4
Chainguardkayenta-2025.0no fix
Chainguardkayenta-2025.1no fix
Chainguardkayenta-2025.22025.2.4-r6
Chainguardkayenta-2025.42025.4.3-r8
Chainguardkayenta-2026.02026.0.2-r8
Chainguardkayenta-2026.12026.1.0-r1
Chainguardkayenta-fips-2025.0no fix
Chainguardkayenta-fips-2025.1no fix
Chainguardkayenta-fips-2025.22025.2.4-r7
Chainguardkayenta-fips-2025.42025.4.3-r9
Chainguardkayenta-fips-2026.02026.0.2-r9
Chainguardkayenta-fips-2026.12026.1.0-r1
Chainguardkeycloak-26.4no fix
Chainguardkeycloak-26.4-iamguarded-compatno fix
Chainguardkeycloak-26.4-operatorno fix
Chainguardkeycloak-26.5no fix
Chainguardkeycloak-26.5-iamguarded-compatno fix
Chainguardkeycloak-26.5-operatorno fix
Chainguardkeycloak-26.626.6.1-r2
Chainguardkeycloak-26.6-iamguarded-compat26.6.1-r2
Chainguardkeycloak-26.6-operator26.6.1-r2
Chainguardkeycloak-fips-26.4no fix
Chainguardkeycloak-fips-26.4-iamguarded-fipsno fix
Chainguardkeycloak-fips-26.4-operatorno fix
Chainguardkeycloak-fips-26.526.5.7-r10
Chainguardkeycloak-fips-26.5-iamguarded-fips26.5.7-r10
Chainguardkeycloak-fips-26.5-operator26.5.7-r10
Chainguardkeycloak-fips-26.626.6.1-r3
Chainguardkeycloak-fips-26.6-iamguarded-fips26.6.1-r3
Chainguardknative-kafka-broker-1.20-dispatcher-loom1.20.3-r6
Chainguardknative-kafka-broker-1.20-receiver-loom1.20.3-r6
Chainguardknative-kafka-broker-1.21-dispatcher-loom1.21.4-r2
Chainguardknative-kafka-broker-1.21-receiver-loom1.21.4-r2
Chainguardknative-kafka-broker-1.22-dispatcher-loom1.22.1-r1
Chainguardknative-kafka-broker-1.22-receiver-loom1.22.1-r1
Chainguardknative-kafka-broker-fips-1.20-dispatcher-loom1.20.3-r6
Chainguardknative-kafka-broker-fips-1.20-receiver-loom1.20.3-r6
Chainguardknative-kafka-broker-fips-1.22-dispatcher-loom1.22.1-r1
Chainguardknative-kafka-broker-fips-1.22-receiver-loom1.22.1-r1
Chainguardkserve-modelmesh0.12.0-r33
Chainguardlocalstack4.14.0-r10
Chainguardlogstash-8.198.19.15-r1
Chainguardlogstash-8.19-iamguarded-compat8.19.15-r1
Chainguardlogstash-8.19-with-output-opensearch8.19.15-r1
Chainguardlogstash-9.09.0.8-r23
Chainguardlogstash-9.0-iamguarded-compat9.0.8-r23
Chainguardlogstash-9.0-with-output-opensearch9.0.8-r23
Chainguardlogstash-9.19.1.10-r8
Chainguardlogstash-9.1-bitnami-compat9.1.10-r8
Chainguardlogstash-9.1-iamguarded-compat9.1.10-r8
Chainguardlogstash-9.1-with-output-opensearch9.1.10-r8
Chainguardlogstash-9.29.2.8-r4
Chainguardlogstash-9.2-iamguarded-compat9.2.8-r4
Chainguardlogstash-9.2-with-output-opensearch9.2.8-r4
Chainguardlogstash-9.39.3.4-r4
Chainguardlogstash-9.3-iamguarded-compat9.3.4-r4
Chainguardlogstash-9.3-with-output-opensearchno fix
Chainguardlogstash-fips-9.3no fix
Chainguardlogstash-fips-9.3-iamguarded-compatno fix
Chainguardmanagement-api-for-apache-cassandra-4.00.1.117-r1
Chainguardmanagement-api-for-apache-cassandra-4.10.1.117-r1
Chainguardmanagement-api-for-apache-cassandra-5.00.1.117-r1
Chainguardneo4j-2025.08no fix
Chainguardneo4j-2025.10no fix
Chainguardneo4j-2025.11no fix
Chainguardneo4j-2025.12no fix
Chainguardneo4j-2026.012026.01.4-r1
Chainguardneo4j-2026.022026.02.3-r4
Chainguardneo4j-2026.032026.03.1-r4
Chainguardneo4j-2026.042026.04.0-r3
Chainguardneo4j-4.4no fix
Chainguardneo4j-5.265.26.25-r2
Chainguardnuxeo-20232023.40-r4
Chainguardopensearch-22.19.4-r14
Chainguardopensearch-2-ml-commons2.19.4-r14
Chainguardopensearch-2-performance-analyzer2.19.4-r13
Chainguardopensearch-2-performance-analyzer2.19.4-r14
Chainguardopensearch-2-repository-azure2.19.4-r13
Chainguardopensearch-2-repository-azure2.19.4-r14
Chainguardopensearch-2-repository-s32.19.4-r14
Chainguardopensearch-2-repository-s32.19.4-r13
Chainguardopensearch-2-security2.19.4-r14
Chainguardopensearch-2-transport-nio2.19.4-r14
Chainguardopensearch-33.6.0-r5
Chainguardopensearch-3-discovery-ec23.8.0-r3
Chainguardopensearch-3-iamguarded-compat3.8.0-r3
Chainguardopensearch-3-ml-commons3.6.0-r5
Chainguardopensearch-3-neural-search3.8.0-r3
Chainguardopensearch-3-notifications3.6.0-r5
Chainguardopensearch-3-performance-analyzer3.6.0-r5
Chainguardopensearch-3-repository-azure3.6.0-r5
Chainguardopensearch-3-repository-s33.6.0-r5
Chainguardopensearch-3-security3.6.0-r5
Chainguardopensearch-3-security-analytics3.7.0-r0
Chainguardopensearch-fips-33.7.0-r0
Chainguardopensearch-fips-3-ml-commons3.7.0-r0
Chainguardopensearch-fips-3-notifications3.7.0-r0
Chainguardopensearch-fips-3-performance-analyzer3.7.0-r0
Chainguardopensearch-fips-3-repository-azure3.7.0-r0
Chainguardopensearch-fips-3-repository-s33.7.0-r0
Chainguardopensearch-fips-3-security3.7.0-r0
Chainguardopensearch-fips-3-security-analytics3.7.0-r0
Chainguardpinot-fips1.5.0-r2
Chainguardrangerno fix
Chainguardreposilite3.5.28-r3
Chainguardseata-server2.6.0-r9
Chainguardselenium-server4.44.0-r0
Chainguardsonarqube26.7.0.124771-r0
Chainguardspark-3.5-scala-2.123.5.8-r13
Chainguardspark-3.5-scala-2.133.5.8-r13
Chainguardspark-4.0-scala-2.134.0.2-r12
Chainguardspark-4.1-scala-2.134.1.2-r0
Chainguardspark-4.1-scala-2.134.1.2-r1
Chainguardspark-fips-3.5-scala-2.123.5.8-r1
Chainguardspark-fips-3.5-scala-2.133.5.8-r1
Chainguardspark-fips-4.1-scala-2.134.1.1-r14
Chainguardspark-kubernetes-operator0.9.0-r0
Chainguardspark-kubernetes-operator-fips0.9.0-r0
Chainguardstrimzi-kafka-operator-cluster-operator0.51.0-r25
Chainguardstrimzi-kafka-operator-fips-cluster-operator1.0.0-r0
Chainguardstrimzi-kafka-operator-fips-kafka-agent1.0.0-r0
Chainguardstrimzi-kafka-operator-fips-kafka-init1.0.0-r0
Chainguardstrimzi-kafka-operator-fips-kafka-thirdparty-libs-cc1.0.0-r0
Chainguardstrimzi-kafka-operator-fips-topic-operator1.0.0-r0
Chainguardstrimzi-kafka-operator-fips-tracing-agent1.0.0-r0
Chainguardstrimzi-kafka-operator-fips-user-operator1.0.0-r0
Chainguardstrimzi-kafka-operator-kafka-agent0.51.0-r25
Chainguardstrimzi-kafka-operator-kafka-init0.51.0-r25
Chainguardstrimzi-kafka-operator-kafka-thirdparty-libs-cc0.51.0-r25
Chainguardstrimzi-kafka-operator-topic-operator0.51.0-r25
Chainguardstrimzi-kafka-operator-tracing-agent0.51.0-r25
Chainguardstrimzi-kafka-operator-user-operator0.51.0-r25
Chainguardtez0.10.5-r12
Chainguardthingsboard-tb-mqtt-transport4.3.1.1-r5
Chainguardthingsboard-tb-node4.3.1.1-r5
Chainguardtrino-plugin-delta-lake481-r0
Chainguardtrino-plugin-elasticsearch481-r0
Chainguardtrino-plugin-exchange-filesystem481-r0
Chainguardtrino-plugin-exchange-hdfs481-r0
Chainguardtrino-plugin-hive481-r0
Chainguardtrino-plugin-hudi481-r0
Chainguardtrino-plugin-iceberg481-r0
Chainguardtrino-plugin-lakehouse481-r0
Chainguardtrino-plugin-opensearch481-r0
Chainguardtrino-plugin-pinot481-r0
Chainguardtrino-plugin-redshift481-r0
Chainguardtrino-plugin-spooling-filesystem481-r0
Chainguardtrino-plugin-thrift481-r0
Chainguardwavefront-proxy13.9-r13
Chainguardwazuh-indexer4.14.5-r0
Chainguardwazuh-indexer4.14.4-r4
Chainguardwazuh-indexer-plugin-ml-commons4.14.4-r4
Chainguardwazuh-indexer-plugin-performance-analyzer4.14.4-r4
Chainguardwazuh-indexer-plugin-security4.14.4-r4
Chainguardzipkin3.6.1-r6
Chainguardzipkin-slim3.6.1-r6
Debian 12nettyno fix
Debian 13nettyno fix
Debian 14nettyno fix
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSnetty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSSnetty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSnetty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSSnetty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise Module for Development Tools 15 SP7netty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise Module for Package Hub 15 SP7netty4.1.133-150200.4.46.1
SUSE Linux Enterprise Server 15 SP4-LTSSnetty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise Server 15 SP5-LTSSnetty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise Server 15 SP6-LTSSnetty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4netty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise Server for SAP Applications 15 SP5netty-tcnative2.0.77-150200.3.39.1
SUSE Linux Enterprise Server for SAP Applications 15 SP6netty-tcnative2.0.77-150200.3.39.1
Ubuntu 25.10nettyno fix
Ubuntu 26.10nettyno fix
Ubuntu Pro 14.04 LTSnettyno fix
Ubuntu Pro 16.04 LTSnettyno fix
Ubuntu Pro 18.04 LTSnettyno fix
Ubuntu Pro 20.04 LTSnettyno fix
Ubuntu Pro 22.04 LTSnettyno fix
Ubuntu Pro 24.04 LTSnettyno fix
Ubuntu Pro 26.04 LTSnettyno fix
Wolfiakhq0.27.1-r1
Wolfiapache-activemq-artemis2.54.0-r2
Wolfiapache-activemq-artemis2.54.0-r1
Wolfiapache-nifi2.9.0-r6
Wolfiapache-nifi-registry2.9.0-r8
Wolfiapache-pulsar-4.14.1.3-r15
Wolfiapache-pulsar-4.24.2.1-r2
Wolfiapicurio-registry3.2.1-r3
Wolficeleborn-0.60.6.3-r3
Wolficeleborn-0.6no fix
Wolficeleborn-0.60.6.3-r7
Wolfidocker-selenium-base4.43.0.20260404-r2
Wolfidruid37.0.0-r1
Wolfiflyway12.6.1-r0
Wolfiflyway12.9.0-r0
Wolfiinfinispan-16.116.1.3-r2
Wolfikeycloak-26.4no fix
Wolfikeycloak-26.4-iamguarded-compatno fix
Wolfikeycloak-26.4-operatorno fix
Wolfikeycloak-26.5no fix
Wolfikeycloak-26.5-iamguarded-compatno fix
Wolfikeycloak-26.5-operatorno fix
Wolfikeycloak-26.626.6.1-r2
Wolfikeycloak-26.6-iamguarded-compat26.6.1-r2
Wolfikeycloak-26.6-operator26.6.1-r2
Wolfikserve-modelmesh0.12.0-r33
Wolfilogstash-9.39.3.4-r4
Wolfilogstash-9.3-iamguarded-compat9.3.4-r4
Wolfilogstash-9.3-with-output-opensearchno fix
Wolfimanagement-api-for-apache-cassandra-5.00.1.117-r1
Wolfineo4j-2025.10no fix
Wolfineo4j-2025.12no fix
Wolfineo4j-2026.012026.01.4-r1
Wolfiopensearch-22.19.4-r14
Wolfiopensearch-33.6.0-r5
Wolfiopensearch-3-discovery-ec23.8.0-r3
Wolfiopensearch-3-iamguarded-compat3.8.0-r3
Wolfiopensearch-3-ml-commons3.6.0-r5
Wolfiopensearch-3-neural-search3.8.0-r3
Wolfiopensearch-3-notifications3.6.0-r5
Wolfiopensearch-3-performance-analyzer3.6.0-r5
Wolfiopensearch-3-repository-azure3.6.0-r5
Wolfiopensearch-3-repository-s33.6.0-r5
Wolfiopensearch-3-security3.6.0-r5
Wolfiopensearch-3-security-analytics3.7.0-r0
Wolfiselenium-server4.44.0-r0
Wolfisonarqube26.7.0.124771-r0
Wolfispark-4.0-scala-2.134.0.2-r12
Wolfispark-4.1-scala-2.134.1.2-r1
Wolfispark-4.1-scala-2.134.1.2-r0
Wolfistrimzi-kafka-operator-cluster-operator0.51.0-r25
Wolfistrimzi-kafka-operator-kafka-agent0.51.0-r25
Wolfistrimzi-kafka-operator-kafka-init0.51.0-r25
Wolfistrimzi-kafka-operator-kafka-thirdparty-libs-cc0.51.0-r25
Wolfistrimzi-kafka-operator-topic-operator0.51.0-r25
Wolfistrimzi-kafka-operator-tracing-agent0.51.0-r25
Wolfistrimzi-kafka-operator-user-operator0.51.0-r25
Wolfitez0.10.5-r12
Wolfithingsboard-tb-mqtt-transport4.3.1.1-r5
Wolfithingsboard-tb-node4.3.1.1-r5
Wolfitrino-plugin-delta-lake481-r0
Wolfitrino-plugin-elasticsearch481-r0
Wolfitrino-plugin-exchange-filesystem481-r0
Wolfitrino-plugin-exchange-hdfs481-r0
Wolfitrino-plugin-hive481-r0
Wolfitrino-plugin-hudi481-r0
Wolfitrino-plugin-iceberg481-r0
Wolfitrino-plugin-lakehouse481-r0
Wolfitrino-plugin-opensearch481-r0
Wolfitrino-plugin-pinot481-r0
Wolfitrino-plugin-redshift481-r0
Wolfitrino-plugin-spooling-filesystem481-r0
Wolfitrino-plugin-thrift481-r0
Wolfiwavefront-proxy13.9-r13
Wolfizipkin3.6.1-r6
Wolfizipkin-slim3.6.1-r6
openSUSE Tumbleweednetty4.1.133-1.1