CVE-2026-93566

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

View on CVE.org
Published Sep 18, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.

Remediation

Vendor Workaround

See https://github.com/netty/netty/security/advisories/GHSA-rq4j-fc47-9698 for fixed versions and remediation guidance.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/a:redhat:jboss_enterprise_application_platform:8 cpe:/a:redhat:jboss_enterprise_application_platform:8.1
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:build_keycloak: cpe:/a:redhat:build_keycloak:26.4::el9
cpe:/a:redhat:build_keycloak:26.6::el9
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:debezium:3 cpe:/a:redhat:debezium:3.6
References
Type Values Removed Values Added
First Time appeared Redhat quarkus
CPEs cpe:/a:redhat:quarkus:3.27::el8
cpe:/a:redhat:quarkus:3.33::el8
Vendors & Products Redhat quarkus
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
References
Type Values Removed Values Added
First Time appeared Red Hat
Red Hat red Hat Amq Broker 7
Redhat build Of Apache Camel For Quarkus
Redhat build Of Apache Camel For Spring Boot
Redhat build Of Apicurio Registry
Redhat build Of Debezium 3
Redhat build Of Keycloak
Redhat build Of Quarkus
Redhat data Grid 8
Redhat quay 3
Redhat single Sign-on
Vendors & Products Red Hat
Red Hat red Hat Amq Broker 7
Redhat build Of Apache Camel For Quarkus
Redhat build Of Apache Camel For Spring Boot
Redhat build Of Apicurio Registry
Redhat build Of Debezium 3
Redhat build Of Keycloak
Redhat build Of Quarkus
Redhat data Grid 8
Redhat quay 3
Redhat single Sign-on
Type Values Removed Values Added
CPEs cpe:/a:redhat:quarkus:3
Vendors & Products Redhat quarkus
References
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Description ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
Type Values Removed Values Added
Description ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`;`), so a chunk size line containing an embedded bare CR (e.g. `0\rX`) is accepted instead of rejected, enabling HTTP request smuggling. ### Details `io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions` only runs the strict validator `HttpChunkLineValidatingByteProcessor` when a `;` is present: ```java int extensionsStart = line.bytesBefore((byte) ';'); if (extensionsStart == -1) { return; } ``` According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A `chunk-size = 1*HEXDIG` ### PoC ```java @Test public void test() { String requestStr = "POST / HTTP/1.1\r\n" + "Host: localhost\r\n" + "Transfer-Encoding: chunked\r\n\r\n" + "0\rX\r\n" + "\r\n" + "GET /smuggled HTTP/1.1\r\n" + "Host: localhost\r\n" + "Content-Length: 0\r\n" + "\r\n"; EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder()); assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch
Title Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line
First Time appeared Redhat
Redhat amq Broker
Redhat amq Clients
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat camel Spring Boot
Redhat debezium
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat quarkus
Redhat red Hat Single Sign On
Weaknesses CWE-1035
CPEs cpe:/a:redhat:amq_broker:7
cpe:/a:redhat:amq_clients:2023
cpe:/a:redhat:apicurio_registry:3
cpe:/a:redhat:build_keycloak:
cpe:/a:redhat:camel_quarkus:3
cpe:/a:redhat:camel_spring_boot:4
cpe:/a:redhat:debezium:3
cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jboss_enterprise_application_platform:7
cpe:/a:redhat:jboss_enterprise_application_platform:8
cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:quarkus:3
cpe:/a:redhat:red_hat_single_sign_on:7
Vendors & Products Redhat
Redhat amq Broker
Redhat amq Clients
Redhat apicurio Registry
Redhat build Keycloak
Redhat camel Quarkus
Redhat camel Spring Boot
Redhat debezium
Redhat jboss Data Grid
Redhat jboss Enterprise Application Platform
Redhat jboss Fuse
Redhat quarkus
Redhat red Hat Single Sign On
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}
Earlier changes (6)
Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 6, 2026, 5:27 PM
Reserved
Sep 18, 2026, 10:00 AM

View source JSON

Updated
Sep 22, 2026, 2:28 PM

JSON

Status
Awaiting Analysis
Published
Sep 18, 2026, 3:17 PM
Modified
Nov 6, 2026, 6:18 PM

View source JSON

Severity
Moderate
Public date
Sep 10, 2026, 12:47 AM

View source Bugzilla JSON

Updated
Sep 21, 2026, 7:25 PM

JSON