Is CVE-2026-89044 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89044 being exploited in the wild.

How severe is CVE-2026-89044?

Medium severity, with a CVSS score of 6.5, published 10 September 2026.

Which products and versions are affected?

Netty 4.1.133.Final through 4.1.137.Final, 4.2.13.Final through 4.2.17.Final.

Is there a fix for CVE-2026-89044?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-89044 attacked?

It is attacked over the network.

Am I affected by CVE-2026-89044?

Check whether you run Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89044: Netty HTTP Transfer-Encoding request smuggling

CVE-2026-89044 · Severity: medium · CVSS 6.5 · Published 2026-09-10

Netty is a networking library widely used to build high-performance network applications and web servers. Affected versions fail to properly validate the Transfer-Encoding header in HTTP requests, allowing attackers to craft malformed headers that bypass security checks. An attacker can exploit this to smuggle unauthorized HTTP requests through proxies or load balancers, potentially accessing data intended for other users or injecting malicious requests.

Technologies: Netty. Vendors: Netty.

Quick answers

Is CVE-2026-89044 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89044 being exploited in the wild.
How severe is CVE-2026-89044?: Medium severity, with a CVSS score of 6.5, published 10 September 2026.
Which products and versions are affected?: Netty 4.1.133.Final through 4.1.137.Final, 4.2.13.Final through 4.2.17.Final.
Is there a fix for CVE-2026-89044?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89044 attacked?: It is attacked over the network.
Am I affected by CVE-2026-89044?: Check whether you run Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a request smuggling flaw in Netty's HTTP codec that fails to properly validate the final Transfer-Encoding value in the Transfer-Encoding header. Attackers can exploit this by splitting Transfer-Encoding headers across multiple lines or using malformed values like "chunked, xchunked" to bypass validation logic. When the final encoding is not "chunked," Netty incorrectly decodes the message as chunked, allowing an attacker to split a single HTTP request into two logical requests as seen by a backend server. The vulnerability affects versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final. Patches are available in versions 4.1.138.Final and later, and corresponding 4.2.x patches.

Affected products

Netty Netty 4.1.133.Final through 4.1.137.Final, 4.2.13.Final through 4.2.17.Final

Timeline

2026-09-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.