7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42583

CVE-2026-42583: Netty: Lz4FrameDecoder resource exhaustion

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42583

CVE-2026-42583:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.netty:netty-codec-compression	maven	<= 4.2.12.Final	4.2.13.Final
io.netty:netty-codec	maven	<= 4.1.132.Final	4.1.133.Final

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the io.netty.handler.codec.compression.Lz4FrameDecoder.decode method. This method is responsible for decoding LZ4 compressed frames. According to the vulnerability description and the provided proof-of-concept, an attacker can craft a small packet (22 bytes) with a header indicating a very large decompressedLength (up to 32MB). The vulnerable version of the decode method trusts this header value and proceeds to allocate a ByteBuf of that size before the actual decompression, which can lead to an OutOfMemoryError and a denial of service.

The analysis of the patch confirms this. The commit 387bbd00ed0d3db8201e17b53396119c73d59448 introduces a configurable maxDecompressedLength to the Lz4FrameDecoder. The decode method is modified to validate the decompressedLength from the input stream against this new configurable limit. Previously, the check was against a value derived from the compressionLevel, which was not sufficient to prevent the allocation of a large buffer based on a malicious header. Therefore, any runtime profile during the exploitation of this vulnerability would show the io.netty.handler.codec.compression.Lz4FrameDecoder.decode function being executed just before the memory allocation and subsequent crash.

Vulnerable functions

io.netty.handler.codec.compression.Lz4FrameDecoder.decode

codec/src/main/java/io/netty/handler/codec/compression/Lz4FrameDecoder.java

The `decode` method reads a `decompressedLength` from the input `ByteBuf` and uses it to allocate a new buffer for decompression. The original code lacked a configurable upper bound for this length, allowing an attacker to specify a large value (up to 32MB) in the LZ4 frame header. This would force the server to allocate a large amount of memory with only a small amount of data sent, leading to a resource exhaustion vulnerability. The patch introduces a `maxDecompressedLength` field and validates the header value against it before allocation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.