Executive brief
Netty is a networking library widely used to build high-performance network applications and web servers. Affected versions fail to properly validate the Transfer-Encoding header in HTTP requests, allowing attackers to craft malformed headers that bypass security checks. An attacker can exploit this to smuggle unauthorized HTTP requests through proxies or load balancers, potentially accessing data intended for other users or injecting malicious requests.
Technical details
The vulnerability is a request smuggling flaw in Netty's HTTP codec that fails to properly validate the final Transfer-Encoding value in the Transfer-Encoding header. Attackers can exploit this by splitting Transfer-Encoding headers across multiple lines or using malformed values like "chunked, xchunked" to bypass validation logic. When the final encoding is not "chunked," Netty incorrectly decodes the message as chunked, allowing an attacker to split a single HTTP request into two logical requests as seen by a backend server. The vulnerability affects versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final. Patches are available in versions 4.1.138.Final and later, and corresponding 4.2.x patches.
Affected products
- Netty Netty 4.1.133.Final through 4.1.137.Final, 4.2.13.Final through 4.2.17.Final
Timeline
- 2026-09-10: disclosed