Riskcovery

CVE-2026-42578

Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation

State
Published
Severity
2.9 Low
Published
May 13, 2026
Updated
Sep 18, 2026
Reserved
Apr 28, 2026

Read the record on cve.org

Description

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.

Scores

CVSSScoreVectorSource
4.02.9 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:PGitHub_M
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nredhat-SADP

Weaknesses

  • CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
  • CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Affected Products

ProductVersions
nettynetty
  • >= 4.2.0.Alpha1, < 4.2.13.FinalAffected
  • < 4.1.133.FinalAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.