Executive brief
Netty is a widely used networking framework that helps developers build high-performance web applications and services. A security flaw in its proxy handling component allows attackers to inject malicious data into the communication headers sent to a proxy server. This could be used to bypass security controls, spoof identity, or perform request smuggling attacks, potentially compromising the integrity of the connection between the application and its proxy.
Technical details
A vulnerability exists in Netty's HttpProxyHandler where the newInitialMessage() method explicitly disables header validation by using DefaultHttpHeadersFactory.headersFactory().withValidation(false). When user-provided outboundHeaders are added to the CONNECT request, the lack of CRLF validation allows an attacker who can influence these headers to inject arbitrary HTTP headers. This is an incomplete fix for a previous vulnerability (GHSA-84h7-rjj3-6jx4). Attackers can leverage this to bypass proxy authentication or perform request smuggling. The issue is resolved in versions 4.2.13.Final and 4.1.133.Final by ensuring proper validation is applied to these header fields.
Affected products
- Netty Project Netty < 4.2.13.Final, < 4.1.133.Final
Timeline
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date