Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding
    header blocks, the non-Huffman branch of
    io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a
    string literal before verifying that length bytes are actually present in the compressed field section.
    The wire encoding allows a very large length to be expressed in few bytes. There is no check that length
    <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.
    (CVE-2026-42582)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2308-1 advisory.

    This update for netty, netty-tcnative fixes the following issues

    - CVE-2026-41417: missing validations leads to HTTP request smuggling and RTSP request injection via     start-line       injection in `DefaultHttpRequest.setUri()` (bsc#1264350).
    - CVE-2026-42578: HTTP Header Injection via HttpProxyHandler Disabled Validation in Netty (bsc#1265243).
    - CVE-2026-42579: DNS codec does not enforce RFC 1035 domain name constraints during either encoding or     decoding       (bsc#1265272).
    - CVE-2026-42580: chunk size parser silently overflows int and enables request smuggling attacks     (bsc#1265273).
    - CVE-2026-42581: TE+CL header coexistence in HTTP/1.0 requests bypasses smuggling sanitization     (bsc#1265277).
    - CVE-2026-42583: resource exhaustion and possible denial of service via `Lz4FrameDecoder` (bsc#1265279).
    - CVE-2026-42584: improper handling of inbound responses in `HttpClientCodec` can lead to response     desynchronization       (bsc#1265280).
    - CVE-2026-42585: Netty is an asynchronous, event-driven network application framework (bsc#1265292).
    - CVE-2026-42586: CRLF Injection in Netty Redis Codec Encoder (bsc#1265245).
    - CVE-2026-42587: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy     enables       decompression bomb DoS (bsc#1265246).
    - CVE-2026-44248: Netty is an asynchronous, event-driven network application framework (bsc#1265294).
    - CVE-2026-42582: HTTP/3 QPACK literal unbounded allocation (bsc#1265318).

    Changes for netty:

    - Upgrade to upstream version 4.1.133

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding     header blocks, the non-Huffman branch of     io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a     string literal before verifying that length bytes are actually present in the compressed field section.
    The wire encoding allows a very large length to be expressed in few bytes. There is no check that length     <= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.
    (CVE-2026-42582)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
461444	Echo: io.netty:netty-codec-http3: security update to 4.2.13.Final	Tenable Cloud Security	Echo Local Security Checks	Local	high
461444	Echo: io.netty:netty-codec-http3: security update to 4.2.13.Final	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
321020	SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:2308-1)	Nessus	SuSE Local Security Checks	Local	medium
314845	Linux Distros Unpatched Vulnerability : CVE-2026-42582	Nessus	Misc.	Local	high
441364	SCA: security update for io.netty:netty-codec-http3 (GHSA-2c5c-chwr-9hqw)	Tenable Cloud Security	SCA Checks	Local	high
441364	SCA: security update for io.netty:netty-codec-http3 (GHSA-2c5c-chwr-9hqw)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-42582

high

Tenable Plugins

high

high

medium

high

high

high