Executive brief
Netty is a widely used networking framework for Java applications. A vulnerability in its HTTP client component can cause the software to misinterpret server responses when multiple requests are sent over the same connection. This could allow an attacker to manipulate or intercept data, potentially leading to information disclosure or the disruption of service.
Technical details
A vulnerability exists in Netty's HttpClientCodec where it incorrectly manages the request-response queue when handling HTTP 1xx (informational) responses. Specifically, the codec polls the request queue for every response, including 1xx hints. If a client pipelines a GET request followed by a HEAD request, and the server returns a 103 Early Hints followed by the GET response and then the HEAD response, the codec incorrectly pairs the HEAD request with the GET response body. Because HEAD requests are expected to have no body, the codec skips reading the GET entity bytes, leaving them on the stream. This causes subsequent responses to be parsed from the wrong offset, leading to response smuggling or desynchronization. The issue is fixed in versions 4.1.133.Final and 4.2.13.Final.
Affected products
- Netty netty-codec-http < 4.1.133.Final, < 4.2.13.Final
Timeline
- 2026-05-05: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD