CVE-2026-33870
EUVD-2026-1678727.03.2026, 20:16
Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| netty | netty | 𝑥 < 4.1.132 |
| netty | netty | 4.2.0 ≤ 𝑥 < 4.2.10 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-9 ≤ 𝑥 < * | ADP |
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-9 ≤ 𝑥 < * | ADP |
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-9 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat AMQ Broker 7.12.7 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat AMQ Broker 7.13.5 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat AMQ Broker 7.14.0 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Quarkus 3.20.6 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Quarkus 3.27.3 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat Data Grid 8.6.1 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | 0:4.1.132-1.Final_redhat_00001.1.el8eap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 | 0:4.1.132-1.Final_redhat_00001.1.el8eap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | 0:4.1.132-1.Final_redhat_00001.1.el9eap ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 | 0:4.1.132-1.Final_redhat_00001.1.el9eap ≤ 𝑥 < * | ADP |
| Red Hat | Streams for Apache Kafka 2.9.4 | codec-http ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1776756834 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 | 1776716842 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 | 1776717247 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 | 1776796445 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
Vulnerability Media Exposure
References