THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-42581 (MEDIUM 5.8) — Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. T

[NVD] CVE-2026-42581 (MEDIUM 5.8) — Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. T

lownvdPublished 2026-05-13

CVE-2026-42581 CVSS: 5.8 MEDIUM Published: 2026-05-13T19:17:23.627

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that se

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-42581