CVE-2026-33870: Netty request smuggling via chunked extension quoted-string parsing

CVE-2026-33870 · Severity: high · CVSS 7.5 · Published 2026-03-27

Netty is a popular networking framework used by many Java-based applications and servers to handle web traffic. A flaw in how it processes specific types of web requests (chunked transfer encoding) allows an attacker to 'smuggle' a hidden second request inside a legitimate-looking one. This can be used to bypass security filters, poison web caches, or gain unauthorized access to sensitive data by tricking the server into misinterpreting the boundaries between different user requests.

Technologies: io.netty:netty-codec-http (Maven), Red Hat AMQ Broker. Vendors: Maven, Red Hat.

Quick answers

Is CVE-2026-33870 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33870 being exploited in the wild.
How severe is CVE-2026-33870?
High severity, with a CVSS score of 7.5, published 27 March 2026.
Which products and versions are affected?
io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=0,fixed=4.1.132.Final.
Is there a fix for CVE-2026-33870?
Yes. io.netty:netty-codec-http (Maven): upgrade to 4.1.132.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33870 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33870?
Check whether you run io.netty:netty-codec-http (Maven) or Red Hat AMQ Broker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-http (Maven): upgrade to 4.1.132.Final or later
    # set io.netty:netty-codec-http to 4.1.132.Final in your pom.xml or build.gradle

Technical details

A request smuggling vulnerability exists in Netty's HTTP codec due to improper handling of quoted strings in chunk extensions. According to RFC 9110, chunk extensions can contain quoted strings that may include various characters; however, Netty's parser incorrectly terminates the chunk header when it encounters a CR/LF sequence even if it is inside a quoted string. An attacker can exploit this parsing differential by crafting a chunked request where a smuggled HTTP request is hidden within a quoted-string extension value. While the RFC technically forbids CR/LF within these strings, Netty's failure to reject the malformed request or parse it consistently with downstream proxies allows for the injection of arbitrary requests. This issue is fixed in versions 4.1.132.Final and 4.2.10.Final.

Affected products

  • Netty netty-codec-http < 4.1.132.Final, < 4.2.10.Final
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat AMQ Broker 7.12.7
  • Red Hat Red Hat Data Grid 8.6.1

Identifiers

  • CVE-2026-33870
  • GHSA-pwqr-wmgm-9rr8

Timeline

  • 2026-03-24: advisory: GitHub Security Advisory GHSA-pwqr-wmgm-9rr8 published
  • 2026-03-27: disclosed: CVE-2026-33870 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.