QSearchQSearch

CVE-2026-42577

7.5 HIGH

Netty is an asynchronous, event-driven network application framework

Published: 2026-05-13 · Last updated: 2026-05-18

Severity and scoring

CVSS
7.5 HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
CWE-772

Affected products

VendorProduct
nettynetty

Description

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-50560 — Netty is a network application framework for development of protocol servers and clients (5.3 MEDIUM)
  • CVE-2026-50020 — Netty is a network application framework for development of protocol servers and clients (5.3 MEDIUM)
  • CVE-2026-50011 — Netty is a network application framework for development of protocol servers and clients (7.5 HIGH)
  • CVE-2026-50010 — Netty is a network application framework for development of protocol servers and clients (7.5 HIGH)
  • CVE-2026-50009 — Netty is a network application framework for development of protocol servers and clients (4.8 MEDIUM)

Same CWE

  • CVE-2026-45536 — Netty is a network application framework for development of protocol servers and clients (4.0 MEDIUM)
  • CVE-2026-45287 — OpenTelemetry-Go is the Go implementation of OpenTelemetry
  • CVE-2026-9156 — Tanium addressed a denial of service vulnerability in Tanium Server (6.5 MEDIUM)
  • CVE-2026-3104 — A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain (7.5 HIGH)
  • CVE-2026-23299 — In the Linux kernel, the following vulnerability has been resolved: Bluetooth: purge error queues in socket destructors When TX timesta... (5.5 MEDIUM)