CVE-2026-89044
Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 10, 2026
- Updated
- Sep 18, 2026
- Reserved
- Sep 10, 2026
Description
Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encoding declarations. Attackers can split Transfer-Encoding headers across multiple lines or use values like 'chunked, xchunked' to bypass validation and decode messages as chunked when the final coding is not chunked, enabling request smuggling attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected Products
| Product | Versions |
|---|---|
nettynetty |
|
References
- GitHub Security Advisory (GHSA-hcvj-94mj-jp5c)vendor-advisory
- Fix commit on the 4.1 branch: match the final transfer-coding token exactlypatch
- Fix commit on the 4.2 branchpatch
- Suffix-based chunked-must-be-last check at netty-4.1.137.Finaltechnical-description
- netty netty-4.1.138.Final Release Notesrelease-notes
- netty netty-4.2.18.Final Release Notesrelease-notes
- netty/nettyproduct
- VulnCheck Advisory: Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encodingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.