Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-42585

Netty: HTTP Request Smuggling due to malformed Transfer-Encoding

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

netty netty

  • >= 4.2.0.Alpha1, < 4.2.13.Finalaffected
  • < 4.1.133.Finalaffected

io.netty netty-codec-http

  • >= 4.2.0.Alpha1, < 4.2.13.Finalaffected
  • < 4.1.133.Finalaffected

References