CVE-2026-50020: Netty HTTP request smuggling in HttpObjectDecoder

CVE-2026-50020 · Severity: medium · CVSS 5.3 · Published 2026-06-12

Netty is a popular networking framework used by many Java applications to handle web traffic. A flaw in how it processes incoming HTTP requests allows it to ignore certain hidden characters that should be rejected. This can lead to 'request smuggling,' where an attacker can bypass security filters or interfere with other users' web sessions by confusing the systems that sit between the user and the server.

Technologies: io.netty:netty-codec-http (Maven), Netty Project Codec HTTP. Vendors: Maven, Netty Project.

Quick answers

Is CVE-2026-50020 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50020 being exploited in the wild.
How severe is CVE-2026-50020?
Medium severity, with a CVSS score of 5.3, published 12 June 2026.
Which products and versions are affected?
io.netty:netty-codec-http (Maven) ECOSYSTEM:introduced=4.2.0.Final,fixed=4.2.15.Final.
Is there a fix for CVE-2026-50020?
Yes. io.netty:netty-codec-http (Maven): upgrade to 4.2.15.Final or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50020 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50020?
Check whether you run io.netty:netty-codec-http (Maven), Netty Project Codec HTTP or Netty Project Netty codec-http at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.netty:netty-codec-http (Maven): upgrade to 4.2.15.Final or later
    # set io.netty:netty-codec-http to 4.2.15.Final in your pom.xml or build.gradle

Technical details

The HttpObjectDecoder in Netty's HTTP codec incorrectly implements RFC 9112 §2.2. While the specification only allows servers to ignore empty CRLF lines preceding a request-line, Netty's implementation uses Character.isISOControl() to skip all control characters (0x00–0x1F and 0x7F) and whitespace. This discrepancy allows an attacker to prepend arbitrary control bytes (like NUL, SOH, or STX) to a request. If an upstream proxy or load balancer does not skip these same bytes, it may interpret request boundaries differently than Netty, enabling HTTP request smuggling or desynchronization attacks. The issue is fixed in versions 4.1.135.Final and 4.2.15.Final.

Affected products

  • Netty netty-codec-http >= 4.2.0.Final, <= 4.2.14.Final
  • Netty netty-codec-http <= 4.1.134.Final

Identifiers

  • CVE-2026-50020
  • GHSA-hvcg-qmg6-jm4c

Timeline

  • 2026-06-05: disclosed
  • 2026-06-12: advisory: NVD publication
  • 2026-06-15: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.