https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T13:29:12.359169+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33870 CVE-2026-33870 — Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing 2026-10-07T13:29:12.612413+00:00

Affected: netty, Red Hat Cryostat 4 on RHEL 9, Red Hat AMQ Broker 7.12.7, Red Hat AMQ Broker 7.13.5, Red Hat AMQ Broker 7.14.0, Red Hat Build of Apache Camel 4.14 for Quarkus 3.27, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat build of Quarkus 3.20.6, Red Hat build of Quarkus 3.27.3, Red Hat Data Grid 8.6.1 and 26 more

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

 https://cve.radiocsirt.org/vuln/ghsa-38f8-5428-x5cv GHSA-38f8-5428-x5cv — Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding 2026-10-07T13:29:12.612549+00:00

Affected: Maven: io.netty:netty-codec-http

### Summary Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks.

### Details Netty incorrectly marks a request as chunked when malformed "Transfer-Encoding: chunked, identity" is present. According to RFC https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length

" If a Transfer-Encoding header field is present in a request and the chunked transfer coding is not the final encoding, the message body length cannot be determined reliably; the server MUST respond with the 400 (Bad Request) status code and then close the connection. "

A possible scenario is when Netty is behind a proxy that doesn't reject requests with "Transfer-Encoding: chunked, identity", but prefers "Content-Length" and forwards the content to Netty.

### PoC The test below shows Netty successfully parsing the second request, demonstrating how an attacker can smuggle a second request inside a request body.

```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked, identity\r\n" + "Content-Length: 48\r\n" + "\r\n" + "0\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "\r\n";

EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copied…