Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-33870

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

netty netty

  • < 4.1.132.Finalaffected
  • >= 4.2.0.Alpha1, < 4.2.10.Finalaffected

References