Netty up to 4.1.132.Final/4.2.12.Final HTTP Request setUri crlf injection

Summaryinfo

A vulnerability was found in Netty up to 4.1.132.Final/4.2.12.Final. It has been declared as problematic. This vulnerability affects the function setUri of the component HTTP Request Handler. Executing a manipulation can lead to crlf injection. This vulnerability appears as CVE-2026-41417. The attack may be performed from remote. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Netty up to 4.1.132.Final/4.2.12.Final. This vulnerability affects the function setUri of the component HTTP Request Handler. The manipulation with an unknown input leads to a crlf injection vulnerability. The CWE definition for the vulnerability is CWE-93. The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs. As an impact it is known to affect integrity. CVE summarizes:

Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.

The advisory is available at github.com. This vulnerability was named CVE-2026-41417 since 04/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 313062 (Linux Distros Unpatched Vulnerability : CVE-2026-41417), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.1.133.Final or 4.2.13.Final eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (313062). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• Netty

Version

• 4.1.132.Final
• 4.2.12.Final

Website

• Product: https://github.com/netty/netty/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion