Executive brief
Netty is a popular networking framework used by many Java applications to handle web traffic. A security flaw allows attackers to bypass safety checks when an application updates a web address (URI) after a request has already been created. This can lead to 'request smuggling,' where an attacker can trick a server into seeing multiple hidden requests, potentially bypassing security filters or accessing internal data.
Technical details
A vulnerability exists in Netty's HTTP and RTSP codecs where URI validation is inconsistently applied. While the constructors for DefaultHttpRequest and DefaultFullHttpRequest validate the URI for CRLF and whitespace characters, the public setUri() method does not. Consequently, if an application modifies a request's URI with attacker-controlled input before it is processed by HttpRequestEncoder or RtspEncoder, the encoder writes the malicious URI verbatim into the request line. This enables CRLF injection, allowing an attacker to insert additional HTTP or RTSP requests into the stream, leading to request smuggling, backend desynchronization, or unauthorized request injection. The issue is resolved in versions 4.1.133.Final and 4.2.13.Final.
Affected products
- Netty Project Netty Up to (excluding) 4.1.133.Final, 4.2.0 to (excluding) 4.2.13.Final
Timeline
- 2026-05-05: advisory: GitHub Security Advisory published by maintainers
- 2026-05-06: disclosed: CVE published to NVD