CVE-2026-93562

Overview

Netty's HTTP/1 decoder fails to fully validate malformed Transfer‑Encoding headers, enabling HTTP request smuggling. This flaw allows a remote attacker to inject arbitrary HTTP requests and potentially bypass security controls. It can lead to unauthorized data access or manipulation.

Description

A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources.

Impact

The vulnerability compromises confidentiality, integrity, and availability of services using Netty. Attackers can smuggle requests to bypass firewalls, load balancers, or application logic, exposing sensitive data or allowing further exploitation. Defenders must consider the risk to any application or service that relies on Netty for HTTP processing.

Remediation

Apply the latest Netty release that includes the HTTP/1 decoder patch. If an update is not immediately possible, enforce strict Transfer‑Encoding header validation or reject requests with malformed headers. Monitor traffic for smuggling patterns and update firewall or WAF rules to detect and block smuggled requests.

Risk context

Severity is medium (CVSS 6.5) and no EPSS data is available. The risk is moderate but should be addressed promptly to prevent potential data exposure or service disruption.

Affected products

• Netty
• Netty HTTP/1 decoder