Homepage

Resource Exhaustion The advisory has been revoked - it doesn't affect any version of package logstash-9.2  (opens in a new tab)

Threat Intelligence

EPSS
0.99% (63rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-WOLFILATEST-LOGSTASH92-16879429
  • published26 May 2026
  • disclosed13 May 2026
Report a new vulnerability Found a mistake?

Introduced: 13 May 2026

CVE-2026-42587  (opens in a new tab)
CWE-400  (opens in a new tab)

Amendment

The Wolfi security team deemed this advisory irrelevant for Wolfi:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream logstash-9.2 package and not the logstash-9.2 package as distributed by Wolfi.

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

References