CVE-2026-42587

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>netty</name>
	<range><lt>4.1.133</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Netty is an asynchronous, event-driven network application framework.
	Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor
	accepts a maxAllocation parameter to limit decompression buffer size
	and prevent decompression bomb attacks. This limit is correctly
	enforced for gzip and deflate encodings via ZlibDecoder, but is
	silently ignored when the content encoding is br (Brotli), zstd, or
	snappy. An attacker can bypass the configured decompression limit by
	sending a compressed payload with Content-Encoding: br instead of
	Content-Encoding: gzip, causing unbounded memory allocation and
	out-of-memory denial of service. The same vulnerability exists in
	DelegatingDecompressorFrameListener for HTTP/2 connections. This
	vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-42587</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-42587</url>
    </references>
    <dates>
      <discovery>2026-05-13</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>