Executive brief
Netty is a popular networking library used in many Java applications to handle HTTP requests. An attacker can send a specially crafted HTTP request containing control characters in the chunk-size field to bypass validation checks, leading to HTTP request smuggling attacks. This could allow an attacker to inject unauthorized requests, potentially exposing sensitive data or bypassing security controls.
Technical details
The vulnerability is an HTTP request smuggling flaw (CWE-444) in Netty's HTTP chunk decoding logic. The root cause is insufficient validation of control characters within the chunk-size line of chunked transfer encoding. A remote, unauthenticated attacker can send a crafted HTTP request that exploits this validation bypass to inject arbitrary HTTP requests. The attack vector is network-based and requires no authentication or special preconditions. Successful exploitation can lead to request smuggling, information disclosure, and unauthorized actions. Patches are expected from the Netty project.
Affected products
- Netty Netty
Timeline
- 2026-09-18: disclosed