https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:07:42.523998+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09557 bdu:2026-09557 2026-10-02T10:07:42.978838+00:00 bdu:2026-09557 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0467 certfr-2026-avi-0467 — De multiples vulnérabilités ont été découvertes dans Oracle Database Server. Certaines d'entre elles permettent à un at… 2026-10-02T10:07:42.978905+00:00 certfr-2026-avi-0467 https://cve.radiocsirt.org/vuln/cleanstart-2026-aj02810 Withdrawn: CLEANSTART-2026-AJ02810 — Security fixes in kserve-modelmesh 0.12.0-r0 2026-10-02T10:07:42.978927+00:00

Withdrawn by the publisher.

Affected: CleanStart: kserve-modelmesh

Package kserve-modelmesh version 0.12.0-r0 fixes 20 vulnerabilities: CVE-2026-24281, CVE-2026-24308, CVE-2026-33870, CVE-2026-33871, ghsa-7xrh-hqfc-g7qr...

 https://cve.radiocsirt.org/vuln/euvd-2026-368458 EUVD-2026-368458 2026-10-02T10:07:42.978962+00:00 EUVD-2026-368458 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33870 fkie_cve-2026-33870 2026-10-02T10:07:42.978974+00:00

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

 https://cve.radiocsirt.org/vuln/ghsa-pwqr-wmgm-9rr8 GHSA-pwqr-wmgm-9rr8 — Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing 2026-10-02T10:07:42.978997+00:00

Affected: Maven: io.netty:netty-codec-http

## Summary

Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks.

## Background

This vulnerability is a new variant discovered during research into the "Funky Chunks" HTTP request smuggling techniques:

- <https://w4ke.info/2025/06/18/funky-chunks.html> - <https://w4ke.info/2025/10/29/funky-chunks-2.html>

The original research tested various chunk extension parsing differentials but did not cover quoted-string handling within extension values.

## Technical Details

**RFC 9110 Section 7.1.1** defines chunked transfer encoding:

``` chunk = chunk-size [ chunk-ext ] CRLF chunk-data CRLF chunk-ext = *( BWS ";" BWS chunk-ext-name [ BWS "=" BWS chunk-ext-val ] ) chunk-ext-val = token / quoted-string ```

**RFC 9110 Section 5.6.4** defines quoted-string:

``` quoted-string = DQUOTE *( qdtext / quoted-pair ) DQUOTE ```

Critically, the allowed character ranges within a quoted-string are:

``` qdtext = HTAB / SP / %x21 / %x23-5B / %x5D-7E / obs-text quoted-pair = "\" ( HTAB / SP / VCHAR / obs-text ) ```

CR (`%x0D`) and LF (`%x0A`) bytes fall outside all of these ranges and are therefore **not permitted** inside chunk extensions—whether quoted or unquoted. A strictly compliant parser should reject any request containing CR or LF bytes before the actual line terminator within a chunk extension with a `400 Bad Request` response (as Squid does, for example).

## Vulnerability

Netty terminates chunk header…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10463-1 openSUSE-SU-2026:10463-1 — netty-4.1.132-1.1 on GA media 2026-10-02T10:07:42.979067+00:00

netty-4.1.132-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:10175 RHSA-2026:10175 — Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.1 Release. 2026-10-02T10:07:42.979086+00:00

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing lodash: lodash: Arbitrary code execution via untrusted input in template imports path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path net/url: Incorrect parsing of IPv6 host literals in net/url github.com/traefik/traefik: Traefik: Denial of Service due to incomplete TLS handshake crypto/x509: Incorrect enforcement of email constraints in crypto/x509 rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability github.com/traefik/traefik: Traefik: Information disclosure due to case-insensitive Connection header processing Traefik: github.com/traefik/traefik: Traefik: mTLS bypass allows unauthorized service access via fragmented ClientHello. github.com/traefik/traefik: Traefik: Cross-tenant traffic exposure and host restriction bypass via rule-syntax injection in Knative provider google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation github.com/traefik/traefik: Traefik: Authentication bypass via non-canonical HTTP header injection @fastify/reply-from: @fastify/http-proxy: Fastify Reply From a…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-33870 UBUNTU-CVE-2026-33870 2026-10-02T10:07:42.979145+00:00

Affected: Ubuntu:Pro:14.04:LTS: netty, Ubuntu:Pro:16.04:LTS: netty, Ubuntu:Pro:18.04:LTS: netty, Ubuntu:Pro:20.04:LTS: netty, Ubuntu:Pro:22.04:LTS: netty, Ubuntu:Pro:24.04:LTS: netty, Ubuntu:25.10: netty, Ubuntu:Pro:26.04:LTS: netty

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0846 WID-SEC-W-2026-0846 — Netty: Mehrere Schwachstellen 2026-10-02T10:07:42.979177+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Netty ausnutzen, um Sicherheitsvorkehrungen zu umgehen und einen Denial of Service zu verursachen.