Executive brief
Netty is a networking framework used in many Java applications to handle HTTP traffic. A flaw in its HTTP/2 implementation allows attackers to inject prohibited characters (like null bytes and line breaks) into HTTP headers, which can be exploited for request smuggling or response splitting attacks when HTTP/2 traffic is translated to HTTP/1.1. This could lead to unauthorized access or data manipulation on affected systems.
Technical details
The vulnerability exists in Netty's HTTP/2 stack due to insufficient validation of header field values, allowing injection of NUL, Line Feed, and Carriage Return characters. These prohibited characters become exploitable for request smuggling, header injection, and response splitting attacks when HTTP/2 responses or requests cross a translation boundary to HTTP/1.1. An unauthenticated remote attacker can craft malicious HTTP/2 requests to trigger this behavior.
Affected products
- Netty Project Netty <UNKNOWN>
Timeline
- 2026-09-18: disclosed