Executive brief
Netty is a popular networking framework used by many Java applications to handle web traffic. A flaw in how it processes incoming HTTP requests allows it to ignore certain hidden characters that should be rejected. This can lead to 'request smuggling,' where an attacker can bypass security filters or interfere with other users' web sessions by confusing the systems that sit between the user and the server.
Technical details
The HttpObjectDecoder in Netty's HTTP codec incorrectly implements RFC 9112 §2.2. While the specification only allows servers to ignore empty CRLF lines preceding a request-line, Netty's implementation uses Character.isISOControl() to skip all control characters (0x00–0x1F and 0x7F) and whitespace. This discrepancy allows an attacker to prepend arbitrary control bytes (like NUL, SOH, or STX) to a request. If an upstream proxy or load balancer does not skip these same bytes, it may interpret request boundaries differently than Netty, enabling HTTP request smuggling or desynchronization attacks. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.
Affected products
- Netty netty-codec-http >= 4.2.0.Final, <= 4.2.14.Final
- Netty netty-codec-http <= 4.1.134.Final
Timeline
- 2026-06-05: disclosed
- 2026-06-12: advisory: NVD publication
- 2026-06-15: patched