CVE-2026-42582
Fixed in a distro release EPSS <1%CVSS 7.5
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.
Products: netty, io.netty netty-codec-http3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | io.netty:netty-codec-http3 | 4.2.13.Final |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | apache-hop | 2.17.0-r11 |
| Chainguard | apache-hop-fips | 2.17.0-r11 |
| Chainguard | camunda-8.9 | 8.9.5-r1 |
| Chainguard | camunda-zeebe-8.9 | 8.9.5-r1 |
| Chainguard | celeborn-0.7 | 0.7.0-r1 |
| Chainguard | druid | 37.0.0-r8 |
| Chainguard | opensearch-3 | 3.6.0-r5 |
| Chainguard | opensearch-3-repository-azure | 3.6.0-r5 |
| Chainguard | opensearch-3-security | 3.6.0-r5 |
| Chainguard | opensearch-fips-3 | 3.7.0-r0 |
| Chainguard | opensearch-fips-3-repository-azure | 3.7.0-r0 |
| Chainguard | opensearch-fips-3-security | 3.7.0-r0 |
| Chainguard | spark-4.1-scala-2.13 | 4.1.2-r1 |
| Chainguard | spark-fips-4.1-scala-2.13 | 4.1.1-r14 |
| Chainguard | spark-kubernetes-operator | 0.9.0-r0 |
| Chainguard | spark-kubernetes-operator-fips | 0.9.0-r0 |
| Chainguard | trino-plugin-delta-lake | 481-r0 |
| Chainguard | trino-plugin-exchange-filesystem | 481-r0 |
| Chainguard | trino-plugin-exchange-hdfs | 481-r0 |
| Chainguard | trino-plugin-hive | 481-r0 |
| Chainguard | trino-plugin-hudi | 481-r0 |
| Chainguard | trino-plugin-iceberg | 481-r0 |
| Chainguard | trino-plugin-lakehouse | 481-r0 |
| Chainguard | trino-plugin-pinot | 481-r0 |
| Debian 12 | netty | no fix |
| Debian 13 | netty | no fix |
| Debian 14 | netty | no fix |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP7 | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | netty | 4.1.133-150200.4.46.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | netty-tcnative | 2.0.77-150200.3.39.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | netty-tcnative | 2.0.77-150200.3.39.1 |
| Ubuntu 25.10 | netty | no fix |
| Ubuntu 26.04 LTS | netty | no fix |
| Ubuntu Pro 14.04 LTS | netty | no fix |
| Ubuntu Pro 16.04 LTS | netty | no fix |
| Ubuntu Pro 18.04 LTS | netty | no fix |
| Ubuntu Pro 20.04 LTS | netty | no fix |
| Ubuntu Pro 22.04 LTS | netty | no fix |
| Ubuntu Pro 24.04 LTS | netty | no fix |
| Wolfi | druid | 37.0.0-r8 |
| Wolfi | opensearch-3 | 3.6.0-r5 |
| Wolfi | opensearch-3-repository-azure | 3.6.0-r5 |
| Wolfi | opensearch-3-security | 3.6.0-r5 |
| Wolfi | spark-4.1-scala-2.13 | 4.1.2-r1 |
| Wolfi | trino-plugin-delta-lake | 481-r0 |
| Wolfi | trino-plugin-exchange-filesystem | 481-r0 |
| Wolfi | trino-plugin-exchange-hdfs | 481-r0 |
| Wolfi | trino-plugin-hive | 481-r0 |
| Wolfi | trino-plugin-hudi | 481-r0 |
| Wolfi | trino-plugin-iceberg | 481-r0 |
| Wolfi | trino-plugin-lakehouse | 481-r0 |
| Wolfi | trino-plugin-pinot | 481-r0 |
| openSUSE Tumbleweed | netty | 4.1.133-1.1 |