CVE-2026-42578
EUVD-2026-3012113.05.2026, 19:17
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| netty | netty | 𝑥 < 4.1.133 |
| netty | netty | 4.2.0 ≤ 𝑥 < 4.2.13 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-10 ≤ 𝑥 < * | ADP |
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-10 ≤ 𝑥 < * | ADP |
| Red Hat | Cryostat 4 on RHEL 9 | 4.2.0-10 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 | handler-proxy ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat build of Quarkus 3.27.4 | handler-proxy ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift AI 2.25 | 1783443816 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | 1780948325 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | 1780696380 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 | 1780694994 ≤ 𝑥 < * | ADP |
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 | 1782989027 ≤ 𝑥 < * | ADP |
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| netty-tcnative |
|
Common Weakness Enumeration
- CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')The software receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
- CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
References