Netty: Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding:… (CVE-2026-42581)

The vulnerability CVE-2026-42581 affects Netty's HttpObjectDecoder component in versions prior to 4.2.13.Final and 4.1.133.Final. The issue arises when a request contains both Transfer-Encoding and Content-Length headers; the decoder strips a conflicting Content-Length header improperly. This can lead to security issues related to HTTP request parsing. Apache ActiveMQ Artemis 2.56.0-r1 includes fixes for this vulnerability among others. The CVSS score is 9.8, indicating critical impact with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No active exploits are known. The package is not a cloud service, so remediation requires manual update.

The vulnerability has a CVSS score of 9.8 (critical), indicating a severe impact on confidentiality, integrity, and availability if exploited. It allows an attacker to exploit improper HTTP header parsing, potentially leading to request smuggling or other HTTP-related attacks. No known exploits are currently active in the wild.

A patch is available and remediation requires updating Netty to versions 4.2.13.Final or later, or 4.1.133.Final or later. Apache ActiveMQ Artemis version 2.56.0-r1 includes these fixes. Since this is not a cloud service, users must manually apply the update to mitigate the vulnerability.