Executive brief
Netty is a popular networking library used in Java-based servers and proxies to handle HTTP communication. A flaw in its HTTP/1.1 chunk-size parsing allows an attacker to send malformed requests that bypass security controls in proxy deployments, potentially allowing unauthorized access to backend resources or cache poisoning attacks.
Technical details
The vulnerability exists in netty-codec-http's chunk-size token parser, which incorrectly handles post-digit whitespace in HTTP/1.1 chunked transfer encoding headers. This parsing discrepancy enables HTTP request smuggling attacks where an attacker crafts a request that different entities (proxy vs backend) interpret differently. Remote, unauthenticated exploitation is possible over the network.
Affected products
- Netty Project Netty <UNKNOWN>
Timeline
- 2026-09-18: disclosed