CVE-2026-93574 in Netty
Summary
by MITRE • 09/18/2026
A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The identified vulnerability resides within the netty-codec-http component, a core library responsible for handling HTTP protocol decoding and encoding in Netty-based applications. The specific flaw involves an incorrect parsing mechanism for HTTP/1.1 chunked transfer coding headers. According to RFC 7230, the chunk-size field must be strictly formatted as hexadecimal digits followed by optional whitespace or semicolons before the CRLF terminator. However, this vulnerability arises when a remote attacker sends a specially crafted HTTP request containing a chunk-size token with post-digit whitespace that is not handled correctly by the parser. Instead of rejecting the malformed header or parsing it according to strict standards, the component misinterprets the boundary between the chunk size and the subsequent data or headers. This deviation from expected protocol behavior creates an inconsistency in how the application processes incoming requests compared to how downstream proxies or backend servers might process them if they adhere strictly to RFC 7230 specifications.
This parsing discrepancy directly facilitates HTTP request smuggling, a class of attacks where conflicting interpretations of HTTP message boundaries allow an attacker to inject malicious payloads into subsequent requests. In typical proxy or load-balancer deployments, the front-end device and the back-end server may have different rules for determining where one request ends and another begins. By exploiting this vulnerability in Netty, an attacker can craft a chunked request that appears valid to the vulnerable application but is interpreted differently by intermediate security devices. This misalignment allows the smuggled portion of the request to bypass front-end security controls such as Web Application Firewalls (WAFs), intrusion detection systems, or access control lists. The attacker effectively hides their malicious intent within the legitimate structure of a chunked HTTP message, causing the backend server to execute commands or process data that was intended for a different context or user session.
The operational impact of this vulnerability is significant in environments where Netty serves as an edge proxy, API gateway, or reverse proxy handling untrusted external traffic. Successful exploitation can lead to unauthorized access to sensitive resources, privilege escalation by hijacking administrative sessions, and the ability to perform cross-user request forgery attacks. Furthermore, because HTTP request smuggling undermines the integrity of security boundaries, it can be used as a vector for more complex multi-stage attacks, including cache poisoning or server-side request forgery (SSRF). The lack of strict validation on chunk-size tokens means that even minor deviations in whitespace handling can result in severe security breaches, compromising data confidentiality and availability.
To mitigate this risk, immediate updates to the Netty library are required if a patched version is available from the official maintainers. Organizations should ensure that their dependency management systems pull the latest secure versions of netty-codec-http. In cases where an update cannot be applied immediately, network-level mitigations such as strict HTTP request validation at the load balancer or WAF layer can help detect and block malformed chunked requests before they reach the vulnerable application server. It is also advisable to review deployment architectures to minimize trust assumptions between proxies and backends by ensuring consistent parsing rules across all components in the chain. Regular security audits focusing on HTTP protocol handling and adherence to RFC standards are essential for maintaining robust defense-in-depth strategies against request smuggling vulnerabilities. This issue aligns with CWE-20 Improper Input Validation, as it stems from insufficient checking of user-supplied input data, and is categorized under ATT&CK technique T1534 Internal Service Scanning or related proxy abuse techniques depending on the specific exploitation context.