UBUNTU-CVE-2026-42581

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-42581
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42581.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-42581
Upstream
  • CVE-2026-42581
Downstream
Related
Published
2026-05-13T19:17:00Z
Modified
2026-06-08T23:00:09.940745492Z
Severity
  • 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

References

Affected packages

Ubuntu:25.10
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:4.*
1:4.1.48-10
1:4.1.48-10ubuntu0.25.10.1
1:4.1.48-10ubuntu0.25.10.2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libnetty-java",
            "binary_version": "1:4.1.48-10ubuntu0.25.10.2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42581.json"
Ubuntu:Pro:14.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1

Affected versions

1:3.*
1:3.2.6.Final-2
1:3.2.6.Final-2+deb8u2build0.14.04.1~esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libnetty-java",
            "binary_version": "1:3.2.6.Final-2+deb8u2ubuntu0.1~esm1"
        }
    ],
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42581.json"
Ubuntu:Pro:16.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps-legacy%2Fxenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:4.0.34-1ubuntu0.1~esm4

Affected versions

1:3.*
1:3.2.6.Final-2
1:4.*
1:4.0.32-1
1:4.0.33-1
1:4.0.34-1
1:4.0.34-1ubuntu0.1~esm1
1:4.0.34-1ubuntu0.1~esm2
1:4.0.34-1ubuntu0.1~esm3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libnetty-java",
            "binary_version": "1:4.0.34-1ubuntu0.1~esm4"
        }
    ],
    "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42581.json"
Ubuntu:Pro:18.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Fbionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:4.1.7-4ubuntu0.1+esm6

Affected versions

1:4.*
1:4.1.7-4
1:4.1.7-4ubuntu0.1~esm1
1:4.1.7-4ubuntu0.1
1:4.1.7-4ubuntu0.1+esm1
1:4.1.7-4ubuntu0.1+esm2
1:4.1.7-4ubuntu0.1+esm3
1:4.1.7-4ubuntu0.1+esm4
1:4.1.7-4ubuntu0.1+esm5

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libnetty-java",
            "binary_version": "1:4.1.7-4ubuntu0.1+esm6"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42581.json"
Ubuntu:Pro:20.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Ffocal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:4.1.45-1ubuntu0.1~esm6

Affected versions

1:4.*
1:4.1.33-1
1:4.1.33-2
1:4.1.33-3
1:4.1.45-1
1:4.1.45-1ubuntu0.1~esm1
1:4.1.45-1ubuntu0.1~esm2
1:4.1.45-1ubuntu0.1~esm3
1:4.1.45-1ubuntu0.1~esm4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libnetty-java",
            "binary_version": "1:4.1.45-1ubuntu0.1~esm6"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42581.json"
Ubuntu:Pro:22.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Fjammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:4.1.48-4+deb11u2ubuntu0.1+esm3

Affected versions

1:4.*
1:4.1.48-4
1:4.1.48-4+deb11u1build0.22.04.1
1:4.1.48-4+deb11u2build0.22.04.1
1:4.1.48-4+deb11u2ubuntu0.1~esm1
1:4.1.48-4+deb11u2ubuntu0.1~esm2
1:4.1.48-4+deb11u2ubuntu0.1
1:4.1.48-4+deb11u2ubuntu0.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libnetty-java",
            "binary_version": "1:4.1.48-4+deb11u2ubuntu0.1+esm3"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42581.json"
Ubuntu:Pro:24.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:4.1.48-9ubuntu0.1+esm3

Affected versions

1:4.*
1:4.1.48-7
1:4.1.48-8
1:4.1.48-9
1:4.1.48-9ubuntu0.1~esm1
1:4.1.48-9ubuntu0.1~esm2
1:4.1.48-9ubuntu0.1
1:4.1.48-9ubuntu0.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libnetty-java",
            "binary_version": "1:4.1.48-9ubuntu0.1+esm3"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42581.json"
Ubuntu:Pro:26.04:LTS
netty

Package

Name
netty
Purl
pkg:deb/ubuntu/netty?arch=source&distro=esm-apps%2Fresolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:4.1.48-16ubuntu0.1~esm2

Affected versions

1:4.*
1:4.1.48-10
1:4.1.48-11
1:4.1.48-12
1:4.1.48-13
1:4.1.48-14
1:4.1.48-16

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libnetty-buffer-java",
            "binary_version": "1:4.1.48-16ubuntu0.1~esm2"
        },
        {
            "binary_name": "libnetty-common-java",
            "binary_version": "1:4.1.48-16ubuntu0.1~esm2"
        },
        {
            "binary_name": "libnetty-java",
            "binary_version": "1:4.1.48-16ubuntu0.1~esm2"
        }
    ],
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-42581.json"