CVE-2026-33870 — Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Affected: netty, Red Hat Cryostat 4 on RHEL 9, Red Hat AMQ Broker 7.12.7, Red Hat AMQ Broker 7.13.5, Red Hat AMQ Broker 7.14.0, Red Hat Build of Apache Camel 4.14 for Quarkus 3.27, Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14, Red Hat build of Quarkus 3.20.6, Red Hat build of Quarkus 3.27.3, Red Hat Data Grid 8.6.1 and 26 more

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

GHSA-38f8-5428-x5cv — Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding

Affected: Maven: io.netty:netty-codec-http

### Summary Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks.

### Details Netty incorrectly marks a request as chunked when malformed "Transfer-Encoding: chunked, identity" is present. According to RFC https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length

" If a Transfer-Encoding header field is present in a request and the chunked transfer coding is not the final encoding, the message body length cannot be determined reliably; the server MUST respond with the 400 (Bad Request) status code and then close the connection. "

A possible scenario is when Netty is behind a proxy that doesn't reject requests with "Transfer-Encoding: chunked, identity", but prefers "Content-Length" and forwards the content to Netty.

### PoC The test below shows Netty successfully parsing the second request, demonstrating how an attacker can smuggle a second request inside a request body.

```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked, identity\r\n" + "Content-Length: 48\r\n" + "\r\n" + "0\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "\r\n";

EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copied…

Most recent entries from all

CVE-2026-33870 — Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

GHSA-38f8-5428-x5cv — Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding