THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-42584 (HIGH 7.3) — Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the

[NVD] CVE-2026-42584 (HIGH 7.3) — Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the

lownvdPublished 2026-05-13

CVE-2026-42584 CVSS: 7.3 HIGH Published: 2026-05-13T19:17:24.043

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-42584