Executive brief
Netty is a popular networking library used to build web services and applications. An attacker can bypass security validation by manipulating HTTP request headers, allowing them to split HTTP requests across multiple frames and execute HTTP request smuggling attacks. This can lead to security control bypass, request processing desynchronization, and requests being processed in unintended contexts.
Technical details
The vulnerability exists in Netty's HTTP/1.1 decoder, which fails to properly validate Transfer-Encoding headers. An attacker can split the Transfer-Encoding field across multiple headers, placing a non-final transfer coding (such as gzip or deflate) in the last field. This bypasses validation logic and enables HTTP request smuggling attacks. The vulnerability is network-reachable and requires no authentication or special privileges. Attackers can exploit this to desynchronize request processing between intermediate proxies and backend servers, or to inject malicious requests that bypass security filters.
Affected products
- Netty Project Netty <UNKNOWN>
Timeline
- 2026-09-18: disclosed