← CVE Intelligence

CVE-2026-33870

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing PUBLISHED

Description (CNA)

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly parses quoted strings in HTTP/1.1 chunked transfer encoding extension values, enabling request smuggling attacks. Versions 4.1.132.Final and 4.2.10.Final fix the issue.

Affected (CNA)

Vendor / productVersions
netty / nettyaffected < 4.1.132.Final; affected >= 4.2.0.Alpha1, < 4.2.10.Final

CWE

CWE-444

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 chunked transfer encoding extension values. Due to incorrect parsing of quoted strings, this flaw enables request smuggling attacks, potentially allowing an attacker to bypass security controls or access unauthorized information.