Executive brief
Netty is a widely-used networking library that handles HTTP communication for many Java applications. A flaw in its HTTP/1 decoder fails to properly validate malformed Transfer-Encoding headers, allowing an attacker to inject unauthorized HTTP requests. This could enable attackers to bypass security controls, access unauthorized resources, or poison application behavior.
Technical details
The vulnerability is an HTTP request smuggling flaw in Netty's HTTP/1 decoder caused by incomplete validation of Transfer-Encoding headers. A remote attacker can send specially crafted HTTP requests over the network to exploit this, requiring no authentication or user interaction. Successful exploitation allows injection of arbitrary HTTP requests that may bypass security controls or access restricted resources.
Affected products
- Netty Netty <UNKNOWN>
Timeline
- 2026-09-18: disclosed