Netty versions 4.2.0.Final through 4.2.13.Final contain a flaw in the epoll transport that fails to detect and close TCP connections that receive a RST after being half‐closed. The result is that stale channels remain open for ever, and in some code paths the event loop thread enters a 100 % CPU busy‐loop, leading to a denial of service. The weakness is classified as CWE‑772, improper cleanup of resources.

The affected product is Netty from the vendor Netty. Any deployment using Netty 4.2.0.Final up to and including 4.2.13.Final suffers from this flaw; versions 4.2.13.Final and later are patched.

This vulnerability has a CVSS score of 7.5, indicating high severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, so there is no known active exploitation at this time. However, the attack vector is remote: an adversary can trigger the issue by sending a TCP RST on a half‑closed connection, which is a feasible action for an external attacker, and once triggered it can consume all CPU resources of the affected event loop thread, effectively shutting down the application. The risk remains significant until the software is updated.