CVE-2026-89044

EUVD-2026-75633

10.09.2026, 18:18

Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.

HTTP Request/Response Smuggling

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 19.9%

Affected Products (NVD)

Vendor	Product	Version
netty	netty	4.1.133 ≤ 𝑥 < 4.1.138
netty	netty	4.2.13 ≤ 𝑥 < 4.2.18

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

netty

bookworm	vulnerable
bookworm (security)	vulnerable
forky	vulnerable
sid	vulnerable
trixie	vulnerable
trixie (security)	vulnerable

Ubuntu Releases

Ubuntu Product

Codename

netty

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
resolute	needs-triage
trusty	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

netty-tcnative

suse enterprise desktop 15 SP7	2.0.84-150200.3.51.1 fixed
suse enterprise sap 15 SP4	2.0.84-150200.3.51.1 fixed
suse enterprise sap 15 SP5	2.0.84-150200.3.51.1 fixed
suse enterprise sap 15 SP6	2.0.84-150200.3.51.1 fixed
suse enterprise sap 15 SP7	2.0.84-150200.3.51.1 fixed
suse enterprise server 15 SP4	2.0.84-150200.3.51.1 fixed
suse enterprise server 15 SP5	2.0.84-150200.3.51.1 fixed
suse enterprise server 15 SP6	2.0.84-150200.3.51.1 fixed
suse enterprise server 15 SP7	2.0.84-150200.3.51.1 fixed

Known Exploits!

https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c

Common Weakness Enumeration

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

References

https://github.com/netty/netty

https://github.com/netty/netty/blob/netty-4.1.137.Final/codec-http/src/main/java/io/netty/handler/codec/http/HttpObjectDecoder.java#L866

https://github.com/netty/netty/commit/640d4d3324f7b811a4903d0730c8ccb35500500c

https://github.com/netty/netty/commit/ca87393b0e9e13c493d213a268e727a6d44e1585

https://github.com/netty/netty/releases/tag/netty-4.1.138.Final

https://github.com/netty/netty/releases/tag/netty-4.2.18.Final

https://github.com/netty/netty/security/advisories/GHSA-hcvj-94mj-jp5c

https://www.vulncheck.com/advisories/netty-4.1.133-final-through-4.1.137-final-and-4.2.13-final-through-4.2.17-final-http-request-smuggling-via-transfer-encoding