CVE-2026-41417: Netty CRLF injection in DefaultHttpRequest setUri

CVE-2026-41417 · Severity: medium · CVSS 5.3 · Published 2026-05-06

Netty is a popular networking framework used by many Java applications to handle web traffic. A security flaw allows attackers to bypass safety checks when an application updates a web address (URI) after a request has already been created. This can lead to 'request smuggling,' where an attacker can trick a server into seeing multiple hidden requests, potentially bypassing security filters or accessing internal data.

Technologies: io.netty:netty-codec-http (Maven). Vendors: Maven.

Quick answers

Is CVE-2026-41417 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41417 being exploited in the wild.
How severe is CVE-2026-41417?
Medium severity, with a CVSS score of 5.3, published 6 May 2026.
Which products and versions are affected?
io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=0,fixed=4.1.133.Final.
Is there a fix for CVE-2026-41417?
Yes. io.netty:netty-codec-http (Maven): upgrade to 4.1.133.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41417 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41417?
Check whether you run io.netty:netty-codec-http (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-http (Maven): upgrade to 4.1.133.Final or later
    # set io.netty:netty-codec-http to 4.1.133.Final in your pom.xml or build.gradle

Technical details

A vulnerability exists in Netty's HTTP and RTSP codecs where URI validation is inconsistently applied. While the constructors for DefaultHttpRequest and DefaultFullHttpRequest validate the URI for CRLF and whitespace characters, the public setUri() method does not. Consequently, if an application modifies a request's URI with attacker-controlled input before it is processed by HttpRequestEncoder or RtspEncoder, the encoder writes the malicious URI verbatim into the request line. This enables CRLF injection, allowing an attacker to insert additional HTTP or RTSP requests into the stream, leading to request smuggling, backend desynchronization, or unauthorized request injection. The issue is resolved in versions 4.1.133.Final and 4.2.13.Final.

Affected products

  • Netty Project Netty Up to (excluding) 4.1.133.Final, 4.2.0 to (excluding) 4.2.13.Final

Identifiers

  • CVE-2026-41417
  • GHSA-v8h7-rr48-vmmv

Timeline

  • 2026-05-05: advisory: GitHub Security Advisory published by maintainers
  • 2026-05-06: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.