Executive brief
Netty is a widely used networking framework that helps developers build high-performance web applications and services. A security flaw in its HTTP request handling allows attackers to inject malicious data into file upload requests by using specially crafted filenames containing hidden line-break characters. This could allow an attacker to bypass security filters, perform unauthorized actions on downstream systems, or deliver malicious scripts (XSS) that compromise user sessions.
Technical details
A CRLF injection vulnerability exists in Netty's `HttpPostRequestEncoder` and `FileUpload` implementations (including `DiskFileUpload`, `MemoryFileUpload`, and `MixedFileUpload`). The root cause is the direct concatenation of user-supplied filenames and field names into `Content-Disposition` MIME headers without sanitizing carriage return (\r) or line feed (\n) characters. An attacker who can control the filename of an uploaded file can inject arbitrary MIME headers, override Content-Type values, or manipulate multipart boundaries. This can lead to Cross-Site Scripting (XSS), security bypasses in downstream middleware, or request smuggling within the multipart body. The issue is fixed in versions 4.1.136.Final and 4.2.16.Final by adding validation to the `setFilename()` and encoder methods.
Affected products
- Netty netty-codec-http < 4.1.136.Final, >= 4.2.0.Final, < 4.2.16.Final
Timeline
- 2026-07-14: advisory: GitHub Security Advisory published
- 2026-07-28: disclosed: NVD publication date
- 2026-07-28: patched: Fixes released in 4.1.136.Final and 4.2.16.Final