7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42577

CVE-2026-42577: Netty: epoll transport denial of service via RST on half-closed TCP connection

Netty is an asynchronous, event-driven network application framework. From 4.2.0.Final to 4.2.13.Final , Netty's epoll transport fails to detect and close TCP connections that receive a RST after being half-closed, leading to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread. This vulnerability is fixed in 4.2.13.Final.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42577

CVE-2026-42577:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-transport-native-epoll	maven	< 4.2.13.Final	4.2.13.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service in Netty's native epoll transport, caused by the improper handling of TCP connections that are half-closed and then receive a RST packet. This leads to stale channels that are never cleaned up and can cause a 100% CPU busy-loop in the event loop thread.

The root cause of the vulnerability is a flaw in the management of file descriptors within the epoll set. When a connection is half-closed, the interest in read events might be removed. If a RST is received subsequently, an error event is generated. The vulnerable code failed to unregister the file descriptor from epoll when its interest set became empty. This meant that the event loop would be constantly notified of an error on the file descriptor but would not process it correctly, as it was short-circuited by checks for the half-closed state. This leads to a busy-loop on epoll_wait.

The fixing commit, 0ec3d97fab376e243d328ac95fbd288ba0f6e22d, directly addresses this issue by modifying the io.netty.channel.epoll.EpollIoHandler.submit function. This function is central to managing epoll registrations. The patch introduces logic to detect when the interest set for a file descriptor becomes empty (EpollIoOps.NONE). When this occurs, the function now explicitly calls Native.epollCtlDel to remove the file descriptor from the epoll instance. This prevents the file descriptor from getting into a state where it can cause an infinite loop.

Therefore, io.netty.channel.epoll.EpollIoHandler.submit is the key function where the vulnerability logic resided. During exploitation, this function would be called to update the channel's event registration, and its failure to correctly remove the file descriptor from epoll is what triggers the denial-of-service condition.

Vulnerable functions

io.netty.channel.epoll.EpollIoHandler.submit

transport-classes-epoll/src/main/java/io/netty/channel/epoll/EpollIoHandler.java

This function is responsible for managing a file descriptor's registration with the epoll event notification facility. The vulnerability lies in the fact that this function did not properly handle the scenario where a channel's interest in I/O events becomes zero, which can occur on a half-closed connection that receives a RST. Instead of removing the file descriptor from epoll, it would remain, leading to a state where the event loop could be continuously woken up by error events (`EPOLLHUP`/`EPOLLERR`) without ever closing the channel. This results in a resource leak and a potential 100% CPU busy-loop. The patch fixes this by explicitly removing the file descriptor from epoll when the event interest becomes zero.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.