Security readout for executives and security teams
Plain-English summary
Netty, a widely embedded Java networking library, shipped a proxy client component that trusted caller-supplied HTTP headers without checking for line breaks. An attacker who can influence those headers can smuggle extra instructions into the request the application sends to its outbound proxy. The fix is a version upgrade to 4.2.13.Final or 4.1.133.Final; no active exploitation is cited in the source bundle.
Executive priority
Treat as a high-priority patch cycle item, not an emergency. Schedule upgrades within the next standard patch window and prioritize internet-facing Java services that route outbound traffic through HTTP proxies, since those carry the most realistic exposure.
Technical view
In HttpProxyHandler.newInitialMessage(), Netty built the CONNECT request using DefaultHttpHeadersFactory.headersFactory().withValidation(false) and appended user-supplied outboundHeaders without CRLF validation. Any attacker-influenced header value containing \r\n can inject arbitrary headers or additional request lines toward the proxy. CWE-113 (HTTP Response Splitting) and CWE-93 (CRLF Injection) apply. CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:H/A:N). Fixed in 4.2.13.Final and 4.1.133.Final.
Likely exposure
Applies to Java services and platforms that embed Netty 4.2.x before 4.2.13.Final or 4.1.x before 4.1.133.Final and use HttpProxyHandler to reach an outbound HTTP proxy with header values derived from user-controlled or untrusted input. Red Hat has issued multiple RHSA errata, suggesting broad downstream Java middleware exposure.
Exploitation context
No KEV listing and no public exploitation reports appear in the source bundle. Exploitation requires that an attacker can influence values placed into HttpProxyHandler's outboundHeaders, so risk depends on how the embedding application composes proxy headers. Impact is header injection against the proxy hop, potentially enabling request smuggling or auth header manipulation, not remote code execution.
Researcher notes
Root cause is the explicit withValidation(false) on the headers factory inside newInitialMessage(), combined with unchecked addition of outboundHeaders. Verify whether your calling code sanitizes header values or relies on Netty. Watch for transitive inclusion through gRPC, Reactor Netty, Vert.x, Spring WebFlux, Elasticsearch clients, and other Netty consumers. No public PoC is cited in the bundle; confirm before assuming exploitability in a given deployment.
Mitigation direction
- Upgrade Netty to 4.2.13.Final or 4.1.133.Final across all services and container base images.
- Apply Red Hat RHSA-2026:28010, 25123, 36820, 37390, 23808, and 24502 where products are affected.
- Audit application code that populates HttpProxyHandler outboundHeaders and reject values containing CR or LF.
- Confirm downstream vendors ship a patched Netty in their next release and track SBOM alerts.
Validation and detection
- Inventory Netty versions via SBOM, Maven/Gradle dependency reports, or `mvn dependency:tree` across builds.
- Grep repositories for HttpProxyHandler usage and trace outboundHeaders sources back to untrusted input.
- After upgrade, verify runtime classpath resolves to the fixed Netty version, not a shadowed older copy.
- Track Red Hat VEX and GHSA-45q3-82m4-75jr for updated affected-product statements.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-113: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-93: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-42578 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6redhat-SADPCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
2.9LowVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-05-13T19:02:00.826Z: Reported to Red Hat.
- 2026-05-13T17:57:43.538Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jrCVE reference, GitHub_M · x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-42578CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2477226CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42578.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:28010CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25123CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36820CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37390CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:23808CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24502CVE reference, redhat-SADP · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of CRLF Sequences ('CRLF Injection')
Improper Neutralization of CRLF Sequences ('CRLF Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.