# CVE-2026-93562: Netty HTTP/1 decoder request smuggling

Source: https://junglewise.ai/threats/cve-2026-93562-a-flaw-was-found-in-netty-s-http-1-decoder-incomplete-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93562 · Severity: medium · CVSS 6.5 · Published 2026-09-18

Netty is a widely-used networking library that handles HTTP communication for many Java applications. A flaw in its HTTP/1 decoder fails to properly validate malformed Transfer-Encoding headers, allowing an attacker to inject unauthorized HTTP requests. This could enable attackers to bypass security controls, access unauthorized resources, or poison application behavior.

Technologies: [Netty](https://junglewise.ai/threats/technologies/netty). Vendors: [Netty](https://junglewise.ai/threats/vendors/netty).

## Quick answers

**Is CVE-2026-93562 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93562 being exploited in the wild.

**How severe is CVE-2026-93562?** Medium severity, with a CVSS score of 6.5, published 18 September 2026.

**Which products and versions are affected?** Netty <UNKNOWN>.

**Is there a fix for CVE-2026-93562?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93562 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-93562?** Check whether you run Netty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an HTTP request smuggling flaw in Netty's HTTP/1 decoder caused by incomplete validation of Transfer-Encoding headers. A remote attacker can send specially crafted HTTP requests over the network to exploit this, requiring no authentication or user interaction. Successful exploitation allows injection of arbitrary HTTP requests that may bypass security controls or access restricted resources.

## Affected products

- Netty Netty <UNKNOWN>

## Timeline

- 2026-09-18: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/jbossnetwork/restricted/listSoftware.html](https://access.redhat.com/jbossnetwork/restricted/listSoftware.html)

## Related threats

- [Netty HTTP/1 to HTTP/2 conversion authority mismatch](https://junglewise.ai/threats/cve-2026-93569-netty-http-1-to-http-2-conversion-authority-mismatch)
- [Netty HTTP request smuggling via control characters in chunk size](https://junglewise.ai/threats/cve-2026-93566-netty-http-request-smuggling-via-control-characters-in-chunk-size)
- [Netty RtspDecoder method-token smuggling in RTSP parsing](https://junglewise.ai/threats/cve-2026-93565-netty-rtspdecoder-method-token-smuggling-in-rtsp-parsing)
- [Netty reference-count leak in HAProxy PROXY-v2 decoder](https://junglewise.ai/threats/cve-2026-93564-netty-reference-count-leak-in-haproxy-proxy-v2-decoder)
- [Netty WebSocketServerExtensionHandler denial of service](https://junglewise.ai/threats/cve-2026-93558-netty-websocketserverextensionhandler-denial-of-service)